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ABSTRACT 


This contract resulted In the design o£ an advanced integrated 
avionics system for general aviation aircraft ♦ Although the design 
in most cases did not proceed to the level of detailed circuitry and 
actual software, sufficient investigation was performed to achieve 
a high degree of confidence in the system concepts. In the opinion 
of the research team, the system described is a good approach to use 
in building a practical Integrated 'avionics system for general aviation. 
To further prove this point, and refine the system design, it will 
be necessary to proceed through the steps of building and testing 
one or more prototype systems. 

Some question exists as to the minimum configuration required 
to prove out the system concept. This would seem to depend on the 
eye of the beholder to a considerable degree. We feel that in addition 
to the triple bus, several team processors, at least one display, 
a com, a nav, and part of the flight following capability, some of the 
sensor actuator subsystem should also be included. In one sense, 
a computer could exercise the bus with a few team processors. But 
to actually fly the system, and get a hands on feel for its 
performance and potential, some of each of the< subsystems should be 
included. Voice recognition, engine diagnostics, and other advanced 
concepts should ultimately be possible. Voice generation should be 
included in the system now. Hopefully funds will permit NASA to 
pursue exploration of this new technology 
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SECTION 1 


INTRODUCTION 


BACKGROUND 

Recent technological Innovations in the area of microelectronics' 
has provided the possibility for significant improvements in the efficiency 
and safety of general aviation aircraft. The inclusion of computer 
deduction in the implementation of totally integrated aircraft electronics, 
provides a tool of much greater capability than the unaided pilot who 
must manually scan and mentally integrate the total aircraft system. 

NASA has recognized the need to provide leadership in exploring new 
areas of system integration to help weed out approaches which are not 
direct lines to a profitable product. 


PURPOSE 

The purpose of the candidate advanced avionics system design for 
general aviation aircraft is to begin to understand the practicality of 
utilizing advanced microprocessor technology to make significant improvements 
in the safety and utility of general aviation aircraft. Techniques have 
been used which are markedly beyond what the general aviation industry 
is presently funding in the magnitudes required to bring this technology 
to the point where it will be routinely applied in the general aviation 
fleet. 

SCOPE 

• Efforts have' been made in this candidate system design to identify 
the overall approach and structure which the system should have to meet the 
desired integration, reliability, modularity, and cost objectives. Some 
of the subsystems were looked at in depth. One* such in depth study was 
made of the system busing. Much effort was expended in looking at the 
various alternative busing approaches available. The military 1553A 
bus system was judged too elaborate and expensive for general aviation 
needs. The short confines of the system box and the motherboard concept 
suggested that a parallel etched bus system would be satisfactory. since 
the data must eventually be used in this form. When distances suggest a 
simpler serial approach for the cabling, it seems that a differential 
driver-receiver pair would be sufficient. In fact a test was run in an 
aircraft using such a simple bus. Despite efforts to Induce failure, no 
noise failures were in fact observed during the test flight. (See section 
10 on risk analysis) . 

The preliminary system specification as well as the final system 
specification Included information which indicated the risk of the 
technologies, which was also discussed during the three oral re'vlews. 

A conservative approach has been taken in providing for the computational 
power needed by the system. The central processor subsystems may be 
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judged more powerful than are needed for this application, but jobs 

for a computer have a way of growing when the computer power is available. 

Retrofit to older aircraft, availability of this system to the single 
engine 2 place aircraft, in addition to such aircraft as the Cessna 
402 twin specifically targeted for this design, have been continually 
considered. 

Initially, ways were sought just to make the system work; with some 
hope of achieving the reliability, cost, power, and weight requirements. 

As the design has progressed from the top down, more specific detail in 
some areas has caused a redesign of portions of the system. This will no 
doubt continue as the system enters into the even more detailed design 
phases. So far, it has always been possible to do this redesign within 
the framework laid out for this system. There is no reason why this 
should not continue to be the case for future prototype work. 


r 

DESIGN PHILOSOPHY 

The structure of the candidate system has been chosen to expedite Its 
changing role. An attempt has been made to keep the structure modular so that 
the configuration and content of the system may be readily modified as 
aircraft owner and airway system requirements change. Minimization of the 
ultimate system cost has been observed, while keeping in mind the reliability, 
modularity, and maintainability required of this system. Features have 
been rejected which were considered' to be cost extravagant for the eventual 
system to posses. Useful extra features that will be available because the 
future hardware makes them very cheap to possess, have at times been included. 
The design has received much attention in the hardware and software 
areas which are critical to aircraft safety. The pilot has been considered 
to be a vital part of this system, and has final authority over system 
operations. The system performs actions by itself, but these can always be 
ultimately overruled by the pilot. In some cases the system is most 
Invaluable as a source of rapidly accessible data and alternatives for 
pilot decision making. A block diagram of the advanced avionics system is 
shown in figure 1.1.- Some appreciation of the magnitude of the integration 
task is gleaned by considering figure 1.2. 


SIGNIFICANCE 

This integrated avionics design offers a radical change from the way 
things are done now in a general aviation aircraft. As the airways 
become more crowded with those using this time efficient mode of transportation, 
the potential for Improvements in the margins of safety and efficiency are 
immense. This design provides a framework within which engine reliability, 
weather avoidance, pilot assistance, precision navigation, and efficient 
fuel management may be greatly improved over what now is possible by the 
average pilot in the average aircraft. The new avionics coupled with 
airframe and engine developments should help aviation fulfill its needed 
role as one of the important foms of transportation in this country. 
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Figure 1.1. Typical system block diagram. 
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SECTION 2 


A PILOTS PERSPECTIVE OF THE SYSTEM 


COCKPIT PHILOSOPHY 

The pilot is always in command. This system assists the pilot in 
scanning the many instrumentation pickoffs in the aircraft, and rapidly 
calculates interrelated quantities for the pilot to use. Situation factors 
and possible decision consequences are rapidly available to the pilot for 
perusal before making a decision. The system can become a valuable tool, 
in fact assistant, to be supervised by the pilot. 

The cockpit has been laid out for single pilot operation. If both 
parts of the main display fail, then the backup and/or number two display 
is placed for relatively easy viewing by the pilot. Autopilot controls can 
be overriden by the pilot using manual force or by logical entry to the 
system. Displays are meant to help the pilot in the simplest possible way, 
and reduce confusion and distraction of attention to the minimum. The 
system can even be told to prompt occassionally, in case there is a 
possibility that the pilot needs help to keep alert. How much machine— human 
interaction occurs, is totally determined by what the pilot instructs the 
system to do. 


CESSNA 402 PANEL 

Figure 2.1 shows an IFR equipped Cessna 402 single pilot front panel. 

Both of the dual redundant displays can be used from the left seat. Below 
the center display is the mass memory cassette which holds navigation 
information. Above each display is a set of dedicated pushbuttoms that 
can be used to call up standard display formats. These are titled from 
left to right, FPLAN, PFLT, START, FSET, INIT, TKOFF, ENROUTE, LAND, 

SYSCNG vrhlch are nemonics for flight plan, preflight, start, frequency 
set. Initialization, takeoff, enroute, landing, system change, and display 
change respectively. Below the flat display panels are switches with 
indicators that may be used to turn off, force on, reset, or assign to 
automatic operation any of the subsystems. A numeric input pad with entry 
clear is to the right of each display. Data is also entered by touching 
the face of the displays to indicate choices among displayed alternatives. 

The force overridable engine control quadrant resides in the usual location 
to the right of the pilot. Below the control quadrant is a control panel 
for adjusting audio level, display positioning, setting up the headphone- 
speaker audio paths, etc. An elapsed time meter used to make entries in the 
airframe engine, and avionics logs is at the lower righthand corner of the panel. 

The left display is recessed into the panel while the central display 
projects out above the engine quadrant. This provides room behind the 
central display for the system avionics box. 
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FLIGHT SCENARIOS 


Sample VFR Flight 

In this scenario, to show the flavor of a ”t 3 rpical" VFR flight, 1 of 
the equipment for an IFR flight is presupposed, although it may not be 
redundant. For a less well equipped aircraft, just delete the help received 
from a particular piece of equipment. 

Master power is applied by tossing the switch at the lower left of the 
instrument panel to bring to life those elements which are not always kept 
at the low trickle power level. Orange letters on the black panel background 
announce the time and date, while reminding the pilot to ppef light the 
aircraft, and check the weather, if not already done. The pilot has already 
conferred about the weather, and runs through the lists available by 
touching PFLT to verify that the loading of the aircraft is in limits and 
that nothing else was missed during the preflight. 

A push of the FPLAN button above the display in front of the pilot 
brings up a map of the United States at the same time the pilot presses 
the left engine start button. The engine roars to life and is adjusted 
to best idle speed with the right hand. Six taps of the left forefinger 
selects the departure and destination points on the three levels of 
electronic maps which are presented in sequence. 

Navigational aids are selected from the mass storage tape. An 
appropriate route avoiding all restricted and prohibited areas is plotted on 
the map, now spanning the entire region of the planned flight. A map of 
the airport taxiways and runways may be called up by tapping the TKOFF 
button. The density altitude and the go-stop takeoff runway length is 
displayed on the airport taxiway-runway map. This button also makes 
available an enlarged (third level) map containing the airport as used in the 
FPLAN display. In addition the taxi and takeoff checklists are available in 
this mode of display at a tap of a finger. ATIS, ground, Cpt, tower and 
departure frequencies have been selected from the weekly updated navigation 
tape, which most VFR pilots purchase every six months. ATIS is tapped to 
obtain the airport departure information, which is too loud. Volume is 
adjusted to a lower level by holding down the level reduce button, located 
on the center pedestal below the engine control quadrant. A tap of Cpt, and 
acknowledgement by the voice in the speaker, leads the pilot to transmit 
destination, aircraft type and desired altitude. A transponder squawk is 
assigned. This is easily entered into the buttons to the right of the panel 
and each number is echoed back to the pilot by the voice generation subsystem 
and also accumulatively displayed in the entry verification box as it is 
depressed. One nxmiber was wrong. A push of the CE button, and the entry 
is quickly corrected on the keypad. Transponder is selected by tapping a 
spot on the display panel. Similarly the altimeter setting could be provided 
to the system for a check with that obtained automatically by the dual 
barometric pressure transducers and the stored airport altitude. A 
disagreement between the barometric pressure transducers produces a request 
by the system for an external altimeter setting from the pilot. Entry via 
the right hand keyboard and touching the corresponding box of the display 
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allows the system to conclude that barometric pressure sensing component 
set //I Is not functioning properly and the //2 set is within limits. GND 
is next tapped switching the communications frequency to this value. A 
press of the yoke transmit button and a few words clears the pilot to taxi 
to runway 36R with tower frequency 118.2. This is different than most 
aircraft use for this airport so the pilot taps a spot on the panel 
selecting this choice of frequency rather than the one brought up as the 
automatic choice, (All possibilities are displayed with a dot showing which 
has been selected) . The usual frequencies for an airport departure are 
made conveniently available on the TKOFF display for a mass memory stored 
airport. But any frequency in the system is easily set by pressing the FSET 
button, which causes all the different frequency set devices in the system to 
come up on the display. After the righthand keypad has been used to key in 
values, each* number dutifully echoed both aurally and at a spot on the display, 
the appropriate box is touched. The display acknowledges by filling in the box, 
and the sound system says ”tower" or whatever. The aural system can be 
turned off like any other system, of course. 

The usual pre takeoff tests were made by the system during taxi and 
will be continued at the start of the takeoff roll. Upon nearing the runway 
the pilot touches "tower" on the display and presses the yoke button to 
announce that the aircraft is ready for takeoff on runway 36R. Tower clears 
for takeoff. During rollout the system checks to see if the takeoff should 
be aborted. After flying speed is reached the display switches from runway 
layout to departure map. This may be forced by pushing EJ^ROUTE, selecting 
U.S. map, and areas like in the FPLAN display. On the left side of the 
display in front of the pilot is a vertical situation display. An engine 
monitoring display is usually placed in the center display above the engine 
quadrant. The map and VSI can be switched by pressing the slew toggle which 
can shift the wrap around display in either direction. The ENROUTE button 
gives a detail of the enroute segment about the aircraft, and is obtained 
initially when the button is pressed. ENROUTE thus makes available all of the 
departure, enroute, and arrival maps that the pilot might care to study. 

But, mostly this button is used to select the enroute map about the aircraft 
current position. 

Soon after departure the display begins to shift as the aircraft proceeds 
along the route. It was not necessary to press ENROUTE since the avionics 
knows that the local traffic area display has become invalid. Since this 
pilot likes to keep flying skills sharp, the automatic pilot has not been 
engaged and the pilot hand flies the aircraft over the countryside 
occasionally glancing at the map display for pilotage landmarks to observe. 

The map and the scenery agree as the approximate planned route is followed. 
Nearing the destination, the airport and its frequencies become available 
on the map. Music has been tuned in on the ADF broadcast band, but the 
pilot now sets the upcoming approach control frequency into the priority 
position of the audio control box. Shortly the music is interrupted 
as another pilot calls the airport, and is answered. Any of the various 
communication functions can be assigned priorities in any order desired. 

This is done by pressing the P on the display the number of times that 
entries will be made, and then touching functions in the order of priority. 
Approach Is touched and the yoke mike keyed to report the aircraft. A 
sequence similar to, but in reverse is followed as the aircraft moves 
through the sequence ending with a taxi to the ramp and shutdown. 
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If the autopilot has been engaged, then the route would have been 
followed precisely and the pilot alerted when the airport approach 
control zone neared* All of the pilot time could be used for 
scanning. Inclusion of fool-proof collision avoidance will remove 
even this requirement. 

Departure and arrival at noncontrolled airports are even simpler. 

Only the unicorn frequencies come up on the display with the taxiways 
and airport layout. Of course radar frequencies along the route are 
provided for the pilot to use if this service is desired. 

Instrument Flight Rules. 

IFR flight could start similarly to the VFR flight, but would have 
the following differences: 

1. The switch to departure frequency or ARTCC must be made. 

2. Constant radio communication would be maintained and an 
exact flight path would be flown, probably on autopilot. 

On both VFR and IFR flights potential weather problems would be 
overlaid on the map enroute display from data obtained using radar or 
electrical activity detection. 

Emergency Procedures 

During a rushed departure and takeoff the left engine fails before 
single engine speed is reached in the Cessna 402. The aural system states 
"nose down" while the panel airspeed flashes to indicate Insufficient 
airspeed has been attained. Excessive yaw causes the right engine power 
to be reduced as corrective rudder is applied and the transponder squawks 
an emergency. * Calculations are instantly provided the pilot to show the 
available options, i.e.: to land on the runway ahead, circle back, or try 
to stop straight ahead, based on speed, altitude, weight, runway length 
and wind-providing the pilot entered any required additional information 
prior to takeoff I This data had been entered in haste by the rushed pilot. 

At higher altutudes the alternate airport possibilities can be provided 
to the pilot as well as landing or ditching procedures when time permits 
preparation. 

Failure of portions of the system are brought to the attention of the 
pilot and alternative reconfigurations suggested along with the possible 
consequences. These are worked out with deliberation and by experts for 
rapid use by the pilot during an emergency. 

In this case the pilot is skillful at engine out procedures in general 
and quickly dips the aircraft to attain single engine speed and climbs to 
pattern altitude as full power is resumed In the right engine. (Next time, 
back to more conservative takeoff speeds I) At left base the left half of the 
main display becomes blank. A quick push of the left slew button restores the 
VSD and returns the system to pilot messages normally presented on the right half of 
the display. At this point the right engine sputters also and the system 
announces that the fuel flow is below limits. One suggested cure is to 
turn on the fuel selector valve to the right inboard fuel tank. This quickly 
revives the engine. Nevertheless the pilot has been informed that the field 
is within gliding distance. Next time, the pilot resolves to use the 
optional preflight check list IN FULL. 
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Section 3 


HARDWARE DESCRIPTION 


DESIGN INTRODUCTION 


This integrated avionics system design has been carried 
out to the level which indicates subsystem function, and the 
methods of overall system integration. Sufficient detail 
has been included to allow identification of possible system 
component technologies, and to perform reliability, 
modularity, maintainability, cost, and risk analysis upon 
the system design. In addition the organizational detail is 
adequate to serve as a starting point for a detailed system 
design and analysis based upon the adopted systeDi approaches, 

A high reliability team architecture for the Central 
Processor along with a triple redundant parallel IEEE'“488 
bus system comprises the heart of the system organizational 
approach. Subsystems are plugged into slots located in a 
single integrated system box. In twin engine aircraft, 
serial bussed service modules may be located remotely to 
serve groups of sensors and actuators. Normally two flat 
panel displays provide output to the pilot, while input is 
provided via dedicated buttons, the touch sensitive flat 
panels, and a separate keyboard. Figure 2,1 depicts the front 
panel for a Cessna 402 aircraft. Sensors are distributed 
about the aircraft, as well as the actuators for the control 
surfaces, and the quadrant engine control actuators. The 
sensor-actuator-antenna distribution is shown in figure 1,2. 
All aircraft system functions are integrated including 
navigation, communication, aircraft attitude, display, 'etCt 
as shown in block diagram form in figure 1,1, 

Triple redundant IEEE-488 instrinaentation buses along 
with a redundant team architecture central processor form 
the system framework. Versatile sensor-actuator and display 
subsystems exploit this new integrated approach along with 
advanced navigation, communication, flight following and 
weather avoidance subsystems as described in the following 
pages. 
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BUS SYSTEM 


The bus system consists of three redundant sets of 16 conductors 
each. Communication between subsystems takes place only over 
these conductors. The characteristics of the lines, the drivers 
and receivers, and the protocol are described in IEEE Std. 488-1975. 
This system design adopts the standard completely except for several 
small points. They are: 

a) Each receiver shall be designed so that if the line voltage, 
V, is _< 0.4 volts, the input current, I, must be greater than 
“0.4 ma. 

b) In addition to (a) above, the composite bus tie point 
resistance (receiver input, terminating resistors and 
driver leakage) must be such that if V _> 0.4 volts, 

I must be > -1.5 ma. With the receiver specification given 
above this implies an increase of termination resistors to 
RLi = 8K and RL2 = 15K. See figure 3.1 



This is compared to the 3K and 6.2K values used in IEEE 488-1975, 
page 51. 

c) The mechanical specifications, section 4 of IEEE 488-1975, 
are not applicable to this design. 

The effect of these modifications Is that total subsystem count 
can be increased from 15 to 31 without increasing driver capacity. 

The receiver characteristics identified above are easily met 
with low power Schottky T^L, MOS, or CMOS circuitry. 


Configuration 

The bus structure will be etched onto one layer of a multi-layer 
system mother board. The layers are: 

1) Bus and signal lines 

2) Ground Plane 

3) System Power (14/28 volts) 
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The bus lines are to be 1.0 mm wide lines on 2 mm centers. 

Line thickness shall be plated up to 0. 125 mm. A cover flash of 
electroless gold followed by a silicon elastomer conformal coat 
is used to provide environmental protection. Connection to the bus 
is carried out with miniature connectors, similar to the Elco 8000 
series, soldered to the conductors and riveted at end parts. Connections 
to power and ground planes will be made by use of plated' through holes. 


Bus Interface Modules. 

The system makes use of two types of commercially available 
BIMs. These units are designed to provide all bus protocol operations 
and actual data transfer. 

The BIM used with the CP subsystems is similar to the Zla Tech 
80. It is a microprocessor-memory unit which carries out bus related 
activities via program control. This BIM Implements ail 488 defined 
state diagrams and can pass and receive the control attribute. Memory 
of these BIMs is an extension of subsystem memory and hence it 
becomes an integral part of the computer subsystem. 

The BIM block used on all other subsystem cards is similar to 
the Motorola 68488 LSI device. (Actual availability of the 68488 is 
scheduled for last quarter 77). These devices provide the Talker, 
Listener, Acceptor Handshake and Source Handshake functions but not 
controller. Since only the CPS units can be controllers this is no 
limitation. These single chip devices are fabricated in MOS technology 
and Integrated into the subsystem cards simply as an extended I/O 
modual . 

The bus interface module is an inter-system compatable stand- 
alone unit which will carry out the direct decoding and communication 
a£.-sociated with the parallel bus protocol. (See IEEE Std. #488-1975 
for specific requirements). It must respond to queries, recognize 
primary and secondary addresses, perform all "handshake" functions, 
transmit "requests for service" signals, and act as a channel for 
data flow from bus to subsystem. The BIM will be a general low 
cost LSI circuit capable of being used at any bus interface location. 

It will be capable of being "programmed" to any of 31 addresses 
through the use of 5 external strap pins which will be returned 
to either Vcc or ground. 

Communication over a 488 bus takes place using two 8 
bit bidirectional line sets. One set will be restricted to transmission 
of data bytes, secondary addresses, and status bytes. The other 
line' set* i’s to carry local Interface messages. 



CENTRAL PROCESSOR 


The central processor (CP) controls all major 
interchanges of data between subsystems, system modification 
actions, and generally anything of a system supervisory 
nature. One to four or more central processor subsystems 
(CPSs) in a team architecture, along with a mass memory 
device comprises the overall CP. Communication between the 
CP and other subsystems, as well as interchanges between 
individual CPSs is all performed via three system IEEE-488 
information buses. Software for the system is distributed 
among the individual subsystems, the CP mass memory, and the 
CPS team members as shown in figure 3^2 System time is kept 
by each CPS. 



Figure 3.2. Distribution of software in system. 


original 

OF POOE 






Team Architecture 


The team architecture is a combination of a hardware 
configuration and a software configuration. When the system 
is provided with multiple Central Processor Subsystems, the 
structure provides for continued system operation as long as 
at least one CPS and one bus" is operational. The team 
operating system (TOS) , comprised largely of a collection of 
tables and software for modifying those tables, with the 488 
bus system, provides a means of efficiently carrying out a 
cooperative effort on the system CP work load. The team 
architecture has no single critical element such as a common 
voter element to determine CPS operational validity. On the 
other hand, each CPS is connected to each 488 bus via a 
pilot resetable time out circuit (TOC) . All hardware and 
software used during flight by the CP is repeated in each of 
the CPS team members. Sufficient capabity for emergency 
operation of the aircraft under IFR flight conditions is 
present in each CPS. 

This design of the team architecture uses; 

MULTIPLE 488 BUSES 

MULTIPLE SELF SUFFICIENT CENTRAL PROCESSOR SUBSYSTEMS 
MULTIPLE SETS OF CENTRAL PROCESSOR SOFTWARE 
MULTIPLE SETS OF TIME OUT CIRCUITS 
MULTIPLE PILOT OVERRIDE CAPABILITY 

These components of the system are discussed separately elsewhere. 
This portion of the design description will thus conclude with a 
description of one possible TOS structure as shown in figure 3-3. 
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IN MAIN SAM 
TASK TABLE (TTBL) 



ID# I TASK ADDRESS /LABEL 

LABEL/POINTER TAG 


IN MAIN RAM IN ALL BIMs 

TASK QEUE TABLE (TQTBL) LEVEL TABLE (LTBL) 



SUCCESSOR 'TASK ID # OSB: OPERATIONAL 

STATUS BIT LLNj LEVEL LIMIT NUMBER 

LC: LEVEL COUNTER 


IN ALL BIMs 



NEXT TASK REGISTER (NTR) 


Figure 3,3. Team operating system tables. 




Three tables and a next task word are used in this 
approach to the team OS. These are identified as the task 
table (TTBL) , and the task que table (TQTBL) , level table 
(LTBL), and the next task word. CPS RAM holds the TTBL and 
TQTBL as these do not normally change often diiring aircraft 
operation in a teamwork fashion. One exception is the 
dynamic modification of the software configuration due to 
hardware failure. In this case one bit in each word of the 
TQTBL must be altered in all the RAMs collectively. All 
other changes to these. tables is a local CPS affair. On the 
other hand both the LTBL and the NTR are changed frequently 
by the team OS and so these tables are located in the memory 
of every BIM for every CPS. 

Task (TTBL) . The TTBL contains as many entries as 
there are CP programs which could be* executed. The tasks 
may be placed in the TTBL in any order, but once placed, the 
position of the task defines its ID ntanber. To' elaborate, 
the first entry in the TTBL has the ID number 1, the second 
entry has the ID number 2, etc. Since each CPS is a 
sixteen bit machine, a single word contains sufficient 
capacity for each entry in the TTBL. The first bit in each 
entry is used to indicate whether the remaining 15 bits 
specify the starting location in RAM for the task or whether 
the software still resides in the CPS mass memory, and the 
task must yet be fetched under the label given by the 
remaining 15 bits. We arbitrarily will select 1 to indicate 
a starting address and 0 to specify a label for a program in 
mass memory. 

Task Que Table (TQTBL) . The Task Que Table like 
the TTBL has as many entries as there are CP programs which 
could be executed. The arrangement of tasks in this table 
is according to the ID number as defined for the task by its 
placement in the TTBL. The TQTBL is a linked list of task 
IDs such that all tasks at the same priority level will 
collectively form a circle linkage. Each entry is divided 
into two eight bit bytes. The high order byte specifies the 
ID number of the task which follows this task at the same 
priority level. Usually there are several priority levels in 
the system, and the software in, each level will be linked in 
a closed chain by the TQTBL. The low order byte contains 
job flags, one for each bit, of which the last bit is 
defined to be the task Operational Status Bit (OSB). This bit 
specifies whether the task at that entry is to be executed or 
not. The system is generally free running and cycles among 
the tasks at each level. As a task is examined for 
execution in the TQTBL, this last bit specifies whether the 
software is to be executed in this transit of the circle of 
jobs at this task level. This bit is used to include or 
exclude tasks from running and allows rapid automatic 
reconfiguration of the system according to prestored bit 
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patterns. Arbitrarily we specify that when this bit is 0, it 
Indicates this task is not to be run, and when this last bit 
is 1, this task is to be executed when its turn comes up. A 
diagnostic routine is included by setting its OSB to 1, and^ 
software is deleted as equipment is shut down by setting the 
corresponding operational status bits to 0. Note that bits which 
are used frequently in the TTBL and TQTBL are located at the end 
of the word for ease of testing with bit shift programming. 

Level Table (LTBL) . The Level Table has as many entries 
as the system has priorities. The order of entries in the LTBL 
is according to priority, with tasks needing the most frequent 
service in the first level, which is designated level 0. Those 
tasks needing less frequent service are placed in level 1, etc. 
Each LTBL entry uses four eight bit bytes of the 2K bytes in 
each BIM. The first and second byte contain the ID number 
of the first task in this level to be executed, and the next 
task to be executed in this level respectively. The first 
task is left fixed once the OS is installed, while the next 
task is constantly changed according to the value In the 
TQTBL as software is executed. The third byte contains the 
level. limit number (LLN). This LLN specifies how many times, 
the full circle of tasks at this level is to be executed, 
before operation transfers to the next level, for execution 
of one task from that level, before returning. The fourth 
byte contains the total nimber of times the circle of tasks 
at that level has thus far been executed. When the LLN 
is reached a task is run from the next level and the fourth 
byte reset to zero. 

Next Task Register (NTR). These two bytes of BIM 
-memory contains -the- ID- number of the next' task to he 
executed in the entire multiprocessor system. The first 
byte is used for the next task and the second- byte stores 
the level from which the task was obtained. 


Typically the system will start off with the table 
entries placed by an initialization OS (IDS) which configures 
the software system each time the aircraft electronics are modified. 
The team operating system will initialize certain entries' each 
time the electronics are turned on. The tasks will .have normal 
flight software specified for execution in the TQTBL (OSB =1) 
and a1 1 Lever Counter (LC) entries will be zero. The system 
begins execution at level 0 and selects the task stored in the 
second byte of the first entry of the LTBL. CPS#1 is initialized 
to the task in the high order byte of the level 0 LTBL, while 
CPS#2 is initialized to the task which follows 
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this in the TQTBL. CPS#3 then is initialized in its byte 2 
of the LTBL to the task which follows the task given to 
CPS #2 as specified by the TQTBL, etc. The next task 
register is initialized to the next task in the linked 
circle of the TQTBL, which has not yet been assigned to a CPS, 

When one of the CPSs finishes it's task it then looks 
at the NTR to find what to do next. The team OS in this 
free CPS then looks in the TQTBL to find what task follows 
the task it is about to perform. This is located in the 
first byte of the entry in the TQTBL which corresponds to 
the number yet in the HTR. The free CPS then places this 
number in both the next task register and the LTBL by 
becoming first the bus controller for all working buses, and 
then a talker on all working buses while commanding the BIMs 
for the other CPSs to be listeners. The LTBL and HTR are 
located in the portion of CPS memory that is part of the 2K 
BIM memory and so this operation does not necessarily 
interfere with the operation of the other CPSs. The 2K of 
BIM memory serves as a cache memory for each bus and CPS. 

When the final entry in a level is reached, this will 
be noted by all zeros in the next task entry in the TQTBL. 

The team OS of a free CPS will then increment the LC for 
this level, and compare the LC with the LLN. If the LC is 
less than the LLN, the team OS will then select the next 
task as the number stored in the first byte of that level in 
the LTBL. If the LLN and the LC nijmbers are the same, then 
the team OS will select the task from the second byte of the 
next larger numbered level in the LTBL and place this in the 
NTR along with the higher task level number, for all of the 
CPSs in the BIM cache memories. In addition the first task 
in the first byte of the LTBL in the level which is about to 
complete a cycle, will be placed also in the second byte 
position of that level entry in the LTBL. These operations 
then set up all entries for all CPSs so that the next task 
•will be properly selected by the next free team processor. 

The length of time taken to run software, the size of 
the various LLN numbers, the level in which software is run, 
and the number of tasks in each of the levels all determine 
how often various tasks are executed. Crudely speaking, 
tasks in different levels tend to be run at an order of 
magnitude slower as levels increase, • 

This software timing design was performed to show that 
a method did exist for setting up the team OS. There is 
little doubt that other team structures can be devised but 
they have not been labored at for this contract. 
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Central Processor Subsystem (CPS) 

Each CPS Is a total computer capable of independent 
operation of an emergency portion of the integrated avionics 
system as specified to the pilot in a placard and then 
available in detail electronically from the system. All 
components for each CPS, including memory, are mounted on a 
single printed circuit board which plugs into a single slot 
inside the system box. Each CPS accesses all three 488 
buses through a Bus Interface Module (BIM) and a Time Out 
Circuit (TOC) . None of the CPSs are specialized or 
dedicated to any other subsystem support function except as 
may be handled on a rotational basis by any team CPS. 

See figure 3.4, 

Microprocessor . Each microprocessor is constructed 
utilizing mostly Intel 3000 computing elements and some 
additional ROM, OR, and multiplexer chips. In particular 
eight Central Processing Element (CPE) chips , one 
Microprogram control Unit (MCU) chip, one Interrupt Control 
Unit (ICU) chip, 64 Read Only Memory- (ROM) chips, two 
multiplexers and a multiple OR gate chip are used. The 
microprocessor uses Random Access Memory (RAM) and Charge 
Coupled Device (CCD) memory to be described later. The 
macroprograms written by use of assembly or higher level 
languages , are stored in machine language form in the RAM 
for execution, and CCD for later retrieval and execution in 
RAM. Each macro instruction in RAM causes one or more 
microinstructions to be performed as directed by the 
permanent microcode stored in ROM. Interpretive microcode 
for several different machines is stored in the ROM and can 
be selected, from RAM merely by setting the bits of a latch 
multiplexer. In this system, code written for a 
Motorola M6800, a DEC PDP-8, or a DEC PDP-11 was 
written. 

A microprogram contained in control memory initializes 
the machine when power is first turned on and .supervises the 
fetching of a first macroinstruction from RAM. 

Each macro instruction is decoded by a combination of MCU 
addressing and microcode deduction. This is obtained by the 
macroinstruction sending the MCU to a first ROM address 
where operations are performed which determine the next ROM 
address etc. Simultaneously, ROM bits are used to control 
the CPE chips, the memory, and whatever else the processor 
designer desires. When the microprogram- flows through 
address row 0 and column 15, the interrupt strobe enable 
line of the MCU is raised. The interrupt system responds by 
disabling the row address outputs of the. MCU, and by forcing 
the row entry address of the microprogram Interrupt sequence 
onto the row address bus. This operation is normally 
performed just before each macroinstruction is fetched. 
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Figure 3.4. System Central Processor. 






Eight CPE chips are connected to construct a 16 bit 
processor. The CPE array provides the arithmetic, logic and 
register functions under the control of seven microfunction 
bus input lines, designated F0-F6. These lines are decoded 
internally to select the arithmetic/logic section (ALS) 
function, generate the scratch pad address and control the 
internal multiplexers. 

M“bus inputs are used to bring data from the SAM and 
CCD into the CPE array. Data on the M-bus is multiplexed 
internally for input to the ALS. The scratch 
eleven Internal registers designated RO through R9 and T. 

The output of the scratch pad is multiplexed internally for 
input to the ALS. A variety of arithmetic and logic 
operations may be performed in the ALS including 2's 
complement arithmetic, incrementing, decrementing, logical 
AND, inclusive OR, exclusive NOR, and logic complement. The 
result of an ALS operation may be stored in the accumulator 
or one of the scratch pad registers. Separate left input and 
right output lines, designated LI and RO, are available for 
use in right shift operations. Carry input and carry output 
lines , designated Cl and CO are provided for ripple carry 
propogation. The K-bus is used to mask memory inputs and to 
supply constants to the CPE from the microprogram. 

The MCU controls the sequence in which 
microinstructions are fetched from the ROM, and provides for 
the storing of CO and the control for Cl for the CPE array. 
Microinstruction sequences are mostly designated by using 
codes supplied to the MCU by a portion of the ROM words 
themselves. The MCU decodes these words by using the bit 

^patterns-.-to~determine-whlch- is to-be— the- -next-mle-roprogram 

address. Each address control function of the. MCU is 
specified by an encoding of the lines designated AC0-AC6. 

Data on the macroinstruction bus, PX4-PX7, can be tested by 
the JPX function to' determine the next microprogram address . 
Data on the secondary instruction bus, SX0-SX3, is 
synchronously loaded into the PR latch while data on the 
PX-bus is being tested. During a subsequent cycle, the PR 
latch may be tested by the JPR, JLL, or JRL functions to 
determine the next microprogram address. Flag logic control 
Inputs FC0-FC3 are used to cross .switch the C and Z flags 
with the flag logic input, FI, and the flag logic output, 

FO. The interrupt strobe enable- of the MCU is available on 
the output line- designated ISE and is used to enable the 
interrupt control unit (ICU) . This line is placed in the 
active high state whenever the location, row 0 and column 
15, is selected as an address. The ICU in turn may respond 
to an interrupt on one of it's lines by pulling down the 
enable row address (ERA) input line of the MCU to override 
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any present ROM selected next row address. An alternative 
next row address is gated onto the ROM address lines to 
vector interrupt the microprogram and force it to enter a 
handling routine for whichever device requested the 
interrupt. 

To aid in performing the macroinstructions from diverse 
machines, multiplexers are used to rearrange the bit patterns 
of the macroinstructions. At any one time, only one of the several 
rearrangements is enabled. Which rearrangement is in effect 
is selected by bits of the ROM stored microinstruction. 

Microcode is stored in three groups of ROM. Each group 
of ROM is, dedicated to the microcode required to perform the 
macrocode of a particular processor. In this system 
macrocode for the Motorola M6800, DEC PDP-8A, and PDP-11 
were investigated. Each of the three groups of ROM are organized 
into 1024 addresses by 48 bits. A 2:4 latch demultiplexer 
and one ROM bit is used to help the MCU select the 
particular ROM group and .address in that group for the 
current microinstruction. 

The ROM microinstructions include the following fields: 

AC0-AC6 (7 bits) Controls the next address logic for the MCU. 
P.C0-FC3 (4 bits) Controls the flag logic of the MCU. 

LD (1 bit) When this is in the active high state, the next 

address logic of the MCU loads the data on the 
instruction bus into the microprogram address 
register . 

F0-F6 (7 bits) The micro-function bus controls the CPE ALS 

function and register selection. 

KO-K16 (16 bits) These mask bus inputs provide a separate 

input port to the CPE for the microprogram 
to allow mask or constant values to be injected 
into the program. 

EA (1 bit) Used to enable the address from the CPE to 

the address bus. 

ED (1 bit) Used to enable the data from the CPE to the 

data bus. 

CLK (1 bit) It selects which of the two CPS clocks is active. 

MPX (3 bits) Used to select one of 8 multiplexer bit 

rearrangements . 

RW (1 bit) Determines whether data is to be read or 

written in memory. 

CS (2 bits) Used to select which or both bytes of RAM used-. 
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The additional 4 bits in each ROM word are free for 
future assignment in the detailed design of the control of 
the BIM or local mass memory, etc. 

Local Instruction Memory . The active avionics 
macroprograms and the operating systems are stored in the 
64 k X 8 bit RAM/ROMs. Both the macroprogram ' RAM and ROM are 
random accessible. But the RAtf portion can both be read 
from and written on while the ROM portion is only used for 
reading. Permanent portions of the OS and the routines used 
by it are stored in the ROM. Macroprograms used in the 
avionics subsystems, especially those stored on the CCD 
memory, and those programs which are dynamically altered, as 
well as data from the 488 buses may be temporarily stored in 
RAM. Most of this portion of the memory -is expected to be 
RAM, but the exact proportions are a matter for the detailed 
system design. Normally both 8 bit bytes are- selected for 
reading or writing from the microprocessor as designated by 
the RW bit of the ROM microcode. Another two bits of ROM 
are used for the chip select (CS) input of each RAM to 
enable byte or full word operation. Three hundred 
nanosecond RAM has been chosen as a companion to the 150 
nanosecond microcode cycle time. 

A section of denser mass memory is also included in 
this, system design. This memory could be bubble memory to 
take advantage of the nonvolitility property. It is not clear 
af this 'time which will be the best to use ten years in the 
future. CCD memory is expected to be secure in this system 
because of the backup power supplies used. CCD memory 

avoids some of the addltlona^^e^^nd^^needed_ to., support. 

"bubble memory. 

As seen in figure 3. 4 the CCD memory is 16 bits in. 
width. The device is configured as 16 chips each with 64K 
bits of memory. The chips are arranged into 256 tracks of 
256 bits on each track. A track is merely a 256 bit CCD 
shift register. The local OS loads one of the 256 addresses 
into A0-A7, selecting a track on each of the 16 CCD chips. 

CE Is decoded in the CMD register (CR) loaded from the A bus 
and the addresses are latched from the D bus. 

In addition, a starting memory address is loaded into the 
address counter by decoding a command from the A bus to load 
the actual address from the D bus. Data is read into the 
CCD or taken from CCD In^ block of 256 words. A 
microinstruction uses a bit from the microcode ROM to turn 
on the CCD clock and turn off the main clock labeled #2 in 
the figure. The read/write bit will be set to control the 
RAM information direction of flow. Similarly the Write"* 

Enable (WE) line of the CR will have been latched to the proper 
value at the same time the tracks were selected. The address 
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to the RAM is provided by the counter, and is incremented for 
each word read out of the CCD or written into it. So 256 
contiguous words are either read from RAM into the CCD or 
are read from the CCD into the RAM. When 256 words have been 
counted, the comparator notes this fact and shuts down 
clock //I and restarts clock #2. Thus the CPS does no 
computation, and is interrupted during these data transfers. 
Data can be transferred at the rate of clock #2. The 
system can be made much faster and of lower power by adding 
the hardware- to scan the 256 tracks on the 16 CCDs instead 
of shifting down one track to transfer the words. But in 
this design, only little used diagnostic and system 
reconfiguration software is placed on the CCD. For this 
reason speed is sacrificed to save some hardware. 

Cache Memory . The 2K x 8 RAM associated with 
each BIM provides the cache memory for each CPS. This 
memory is dual ported and so the BIM can place data in these 
locations without significantly interfering with the 
operation of the CPS. This is important since the operation 
of telling the other CPSs what the next task is, is fairly 
often recurring, and Increases with the number of CPSs. 

Time Out Connection (TOC) . Each CPS is connected 
to all three system 488 information buses- with a TOC. See 
figure' 3. 5. The TOC serves to disconnect the CPS from the bus 
should a specified period of time elapse both it and 
one other CPS resets the timing circuit. Thus for- an 
individual TOC to be connecting the CPS to an individtial 488 
bus, the CPS Itself has run a program which resets the TOC 
timer and another CPS has run a program which resets the 
timer. Of course the TOCs are powered up in the connected 
mode. The pilot has a switch for each CPS with separate 
circuits for each TOC, that allows for manual reset-on or off. 
All three TOCs are resettable from a single 488 bus or 
from a single CPS instruction. The time needed between 
resets before a time out disconnect occurs is a matter for , 
the detailed design. 

CP Mass Memory . A common mass memory unit which has 
access to all three 488 buses provides the following 
information to the CPSs. The location of electronic fixes, 
geographic features of the overflown area, and a copy of the 
initialization OS. These first two libraries are on a common 
An lOS tape is provided when the integrated avionics system 
is acquired. The lOS could also be ROM mounted on the mass 
memory subsystem card. 
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operating System QS > Three operating systems' are used 
in this design. Each CPS uses a local operating system to 
fetch .and run programs from the local mass memory as well as 
handle the bus I/O and local software linkages. For two or 
more CPSs in the CP, each CPS also* has the team OS to 
coordinate the multiprocessing teamwork of the CP. In 
addition a third, initialization OS, is required to 
configure the CPS software at subsystem Installation time. This 
last OS fetches system software stored in the individual 
subsystem memories, performs various system compatibility 
checks, and configures a local OS, team' OS, and system software 
package for the CPSs. The distribution of software in the 
system is shown in figure 3.2. 


CP Functions . Software performs the following 
functions dn a fully implemented integrated avionics system. 

The 488 buses will be supervised by the CP to grant 
access to the bus by all non CPS subsystems. In addition, 
for a CPS^/to have talker access to a bus, it must be a 
controller for that bus. 

The CP shall dynamically supervise the actions of all 
subsystems to the degree they have been constructed to 
receive such supervision. 

Flexible task slave subsystems shall be given their 
function by the CP.. Such tasks shall remain fixed for a 
subsystem until changed by the CP. Similarly for multi-task ' 
subsystems. 

The CP shall designate to subsystems the destination 
for all data transfers/ These designations may be for 
single items or data blocks, and may be part of a task 
assignment. ^ 

* * 

The CP shall designate to all subsystems the source for 
all system' bus acquired data.' These designations may be 
part of a task assignment.. 

The CP shall perform the major part of the system 
verification checks for proper system operation. 

The CP shall perform checks, automatically, to verify 
that the operation of the CP is correct. The pilot shall be - 
notified of any CP malfunction detected. Tasks shall 
automatically adjust the CP operation to maintain system 
integrity when any CP malfunction is detected, as reasonably 
feasible. 
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The CP shall perform checks, automatically, to verify 
that each subsystem within the system configuration is 
performing properly. The pilot shall be notified, and the 
system software reconfigured to maintain system operation 
whenever any malfunction is detected. 

-The CP shall collect sensor data and compute suitable 
display aud/or actuator commands for aircraft equipped with 
a flight director, or autopilot. 

The CP shall provide suitable display commands to 
enable the pilot to hand fly the aircraft relative to preset 
attitudes, altitudes, and airspeeds. If the aircraft is 
navigationally coupled, then visual, and/or oral commands 
will be issued to the pilot so as to enable the aircraft to 
be maintained on a 4-D flight plan. 

The CP shall provide navigational computation for the 
system. 

The CP shall with the assistance of electronic fixes 
stored in the common CP mass memory, and tactile input from 
the pilot, compute a flight plan for the pilot in accordance 
with prescribed ATC procedures. This flight plan shall be 
automatically transmitted and updated through the CP, which 
shall maintain a record of said plan, if the system, 
including ATC, is so equipped with direct digital link. 

The CP shall have available a library of all electronic 
position fixes, for which the system is equipped to receive. 

The CP shall automatically command the navigational 
. subsystems- to- both receive these "fixes and confute 
appropriate coordinates. 

The CP shall have available a library of terrain features which 
it relates to the aircraft flight path. The CP shall 
compute safe altitudes and issue warnings if a danger is 
detected. The CP or a designated subsystem processor will be 
responsible for all coupling and computation between the 
navigational subsystems and the flight director and/or 
autopilot capabilities. 

The CP or a designated subsystem processor shall be 
responsible for monitoring the condition of all aircraft 
systems and flight parameters and providing timely warning 
to the pilot of any discrepancies detected from normal or 
designated conditions. 
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The integrated avionics system shall provide assistance' 
to the pilot in performing tasks including but not limited 
to the following: weight and balance, passenger briefing, 

preflight inspection, start of engines, taxi check, 
pre-take-off check, flight planning and entering, flight plan 
alteration. 

Helps will be primarily lists, aural -system responses, 
and graphic displays. Automatic condition monitoring will 
be utilized as appropriate, including any other Information 
the system possesses about the situation, to aid the pilot. 

In the prototype system some of these items may be loaded by 
tape cartridge into system memory. 

The advanced avionics system shall have provision for 
assisting the pilot to act in coping with emergencies 
including but not limited to the following: 

electrical power loss 
impending engine loss 
engine loss 
structural ice 

fuel low relative to specified destination and margins 
loss of any aircraft system 

lack of pilot input for more than a specified period 
impending Impact with ground 
loss of ground to air following 

pilot sick (or totally incapacitated - passenger instructions) 
overheating of engine 
engine icing 

Impending collision with another aircraft (dependent on ARTC 
implementation of DABS) 
hij ack 
lost 
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Table 3.1. 


PROCESSOR SUBSYSTEM PARTS TABLE 


No . Chips 

Description Hybrid 

Groups 

Size 

in^ 

Power 

Each Power 
W Total 

Technology 


2 bit Central Processing Element 

B 

I 


1 

8 

Schottky Bipolar 

Microprogram Control Unit 

B 


2 

1 

1 

Schottky Bipolar 

Interrupt Control Unit 

1 



.5 

1 

Schottky Bipolar 

Time Crystal (with counter in hybrid 

package) 

1 

1 


.1 

.1 

MOS 

150 ns clock //2 (gated output, capacitor) 

D 

1 

.5 

.2 

1.0 

Bipolar 

600 ns clock #1 (countdown from #2) 

B 

1 

.5 

.1 

.1 

MOS 

64K X 1 Random Access Memory, 300 ns 

(proj . ) 

163 

1 

.5 

8.0- 

i2l 

1024 X 8 Read Only Memory, 100 ns (proj.) 

18 

9 

.75 est 

13.5 

Bipolar 

8 Input X 1 Line Multiplexer 

163 

' 

1 

.25 

4.0 

Schottky Bipolar 
Hybrid 

2 Input X 4 Line Multiplexer 

4 

2 

.25 

1.0 

Schottky Bipolar 

Quad 2 Input OR j 

2 

1 

.25 

.5 

Schottky Bipolar 

Hex Inverter 

1 

.5 

.25 

_ 

Schottky Bipolar 

4 Bit Demultiplexer 

1 

.5 

.125 

.13 

Schottky Bipolar 

8 Bit Counter 

2 

1 

.1 

.2 

MOS 

8, Bit Comparator 

1 

.5 

;l 

.1 

MOS 

256K X 1 CCD 

163 

1 

.25 est 

4 

MOS 

4 Phase Clock Generator 

1 

.5 

.1 

.1 

MOS 

BIM 

3 

1.8 

2 est 

6 

MOS Hybrid 

Bus Disconnect 

i 3 

1.5 

.2 

. 6 

MOS 

Voltage Regulator 


2 80% eff. 

55.98 

Total 


The chips given in the table are placed in hybrid assemblies ^ which are in 
turn mounted on the processor subsystem printed circuit card. 

Total chip and hybrid area approximately 27 in^. 

Total' power requirement approximately 60 watts, or 6.5 amps from avionics bus. 
2 Indicates these chips are in a common hybrid package. 
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SENSOR ACTUATOR SUBSYSTEM 


Subsystem Overview 

The Sensor Actuator Subsystem is a multiply redimdant sub-system 
which is connected to all three IEEE standard 488 parallel integrated 
system buses, and resides within the integrated system package. External 
conversation with sensors or actuators will occur: (a) via a receiver 
transmitter system over a shielded twisted pair to a remote service 
module or (b) directly with the sensors or actuators themselves. Each 
subsystem will be modularly constructed and built up to the* degree, 
of complexity required by the aircraft in which it will be installed. 

The most complex form will consist of: 

a) Bus Interface Modules (BIMs) 

b) Actuator preprocessor and subsystem controller 

c) Receiver/ transmitter systems 

d) Remote transmitter/receiver 

e) Remote service modules 

f) Serial and parallel digital transducers 

g) Star connected serial transmission buses. 

A typical system installation, showing maximum capability as well as 
suggested remote station locations is shown in figure. 3.6. The system 
is multiply redundant and each microprocessor controlled service 
channel is capable of providing complete critical sensor/ actuator data 
to the CP via one of three internal busing routes. 



Figure 3.6. Typical system installation. 
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Integrated System Package (ISP) 

In order to maintain bus Integrity and thus insure a high order 
of reliability for the CP team, all activity which relates to 
devices outside the integrated system package will occur through 
highly reliable, buffered, pre-processing units. Figure 3.7 shows 
the structure of one channel of the sensor /actuator subsystem 
components that resides within the integrated system package (ISP) . 

A maximum of four remote stations will be served by each of 
the two sensor actuator channels in the ISP. Dedicated lines to each 
individual remote station form a star configuration from the ISP. 

See figure 3.7. In order to minimize the program complexity, storage 
space and processor speed, a hardware rather than software approach 
will be used for the parallel to serial conversion and communication 
line protocol. 
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Figure 3.7. One channel of the sensor/actuator subsystem. 
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Receiver Transmitter System (RTS) ♦ Interface to remote sensor 
actuator service modules will be accomplished tlirough bidirectlon 
data transfer over a serial data bus via a universal asynchronous 
receiver transmitter (UART) and a bidirectional transmission line 
interface, will accomplish the actual data transfer. (See figure 3.10). 



TWISTED 

SHIELDED 

PAIR 


Figure 3.8. Receiver transmitter system (RTS). 


Transmission line interface: Communication to the remote stations is 

handled in a simple command-response mode. Should an out of limit condition occur, 
the CP will be made aware during routine data delivery by the system. Therefore 
no complicated protocol need be implemented at the remote station communication 
level. This allows all remote stations to reside in a listen mode 
(i.e. transmitters disconnected) until a request to transmit is 
received. The transmission line Interface is therefore no more than 
a differential line driver with a tri-state output control, and a 
standard differential line receiver. See figure 3.9. 


Data out 

Tri-state 
control ““ 

Data in 





Figure 3.9. Transmission line Interface. 
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Universal asynchrous receiver transmitter (UART) : The UART 

consists of a receiver and transmitter designed to provide the necessary 
formatting and control for interfacing serial asynchrous data to and 
from the bidirectional transmission line interface. The receiver- 
transmitter is capable of full duplex operation and is externally 
programnable . 

The transmitter converts parallel data to a serial block containing 
the data, (5-8 bits), a start bit, a parity (optional) bit and a stop 
bit (1, Iht or 2), (See figure 3.10.) 



BIT 


Figure 3,10, Serial data transmission. 


The receiver converts a serial input word with start, data, parity 
and stop bits into parallel data. It verifies proper code by checking 
parity and the receipt of a valid stop bit. There are four registers 
under program control in the UART. One is loaded from the microprocessor 
data bus in the .transmit mode, one is read in the receive mode* A two 
bit data code determines which register is selected and the direction 

of data flow. The following table describes _the UART rest^^^ ' 

~ - selection' code'. 


A B Function 


0 0 Transmit data 

0 1 Receive control data from MP 

1 0 Receive data 

1 1 Send status to MP 

Table of UART function selection codes 

The UART also sends the following signals to the CP via 
hard-wired command lines; 

1) Data available 

2) Transmitter hold register empty 

3) Clear to send 

4) Request to send 

Execution of the UART command structure is implemented by asserting 
3 select lines and applying a strobe pulse. 
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Sensor actuator subsystem communication controller ♦ The control 
of information flow, some pre-processor capability and subsystem 
supervision is under control of a CMOS, microprocessor based, programmed 
data system. This system contains program storage in ROM, dynamic 
memory for interim data storage, channel selection circuitry, and 
UART control information storage. (See figure 3.11.) 
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Figure 3.12 shows the entire single channel portion of the sensor 
actuator subsystem which resides in the Integrated instrument package. 
This communication controller subsystem, communicates with remote sensor 
actuator service modules over four bidirectional serial data buses, 

(when operating in its most complex form). In the event remote stations 
are not required, the RTS portions of this subsystem would be replaced 
xd.th sensor actuator multiplexers and serial to parallel conversion 
hardware. (See figure 3.17 and 3.18). The microprocessor software 
would be changed to accommodate the service duties of one or more remote 
stations , thus eliminating the need for the serial transmission buses • 

It is also expected that a portion of the remote stations could be 
eliminated, with some remote stations Implemented and some sensors being 
connected directly to the ISP subsystem. 

The following table shows a compilation of the component type, 
number and technology utilized, in the Sensor /Actuator subsystem 
communication processor and controller. The data shown represents both 
channels of the dual channel system, (see figure 3.8) but does not 
Include miscellaneous hardware incidentals. 


Table 3.2. Sensor Actuator Subsystem Parts Table 


Quantity 

Type of Unit 

Technology 

6 

Bus Interface Modules (BIMs) 


2 

Microprocessor CP (8 bit) 

CMOS 

2 . 

2K Random Access Memory (RAM) 

CMOS 

2 : 

8K Read Only Menwry. (ROM) , . _ 

_ - CMOS - - 

4- - • - ' 

Latching output ports 

CMOS 

2 

3-8 Oecoders 

CMOS 

8 

UART 

CMOS 

8 

Differential Line Driver 

Bipolar 

8 

Differential Line Receiver 

Bipolar 

2 

Hex Buffer Amplifier 

CMOS 

2 

Crystal 


8 

Quad Nand/Nor Gates 

CMOS 

2 

2K EPROM 

CMOS 


The system is designed’ with module compatabillty such that RTS units 
can be replaced with serial sensor multiplexers or parallel sensor 
channels, and memory expansion is in the form of blocks of ROM program 
to accept such modifications. The EPROM is used to store system 
nominals, correction factors, and limits. This EPROM is programmed 
by the installer for the particular aircraft and configuration. 
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Figure 3.12, Sensor actuator subsystem within the ISP# 




Remote Stations 


The remote station equipment is expected to withstand a more severe 
environment than those components within the ISP. Therefore an effort 
has been made to minimize complexity while maintaining a high degree 
of capability. While the hardware portion of the pre— processor section 
and the RTS section, remain essentially identical to those of the ISP 
hardware, the remote transducers represent maximum simplicity. All 
serial transmitting transducers are of the voltage controlled oscillator 
type (VCO) . This allows existing analog transducers, such as thermocouples 
and solid state pressure transducers, to be converted quickly and 
economically to a form of varying frequency square wave. This square wave 
can be transmitted reliably to the remote service station. In those cases 
where more accuracy or conversion speed is required standard A/D converters 
are employed with parallel data transmission to the remote stations. 

Remote service module . The Service Module will contain a redundant 
microprocessor based controller and associated electronics necessary 
to accomplish: 

a) A/D conversion where necessary. 

b) Assembly of data in a format compatible with the controller. 

c) Sequence data sensors in a priority format. 

d) Deliver requested data to the Central Processor. 

e) Service the remote sensing transducers associated with 
each terminal. 

f) Condition the transducer signal so as to be suitable for analog to 
digital conversion. 

g) Collecting data from the remote sensor serving terminals. 

h) Scaling, linearizing, and normalizing. functions. 

1) Tenqierature compensation of thermocouple junction, drift, etc. 

Igr s^g^ling actual_.temperature -of -mounting- surface and' applying 
corrective data to known drift characteristics. 

j) Making data available for polling by the CP at a specified rate. 

k) Setting actuators to a specified position. 

l) Making specified differential changes in actuator positions, 
as specified by the CP. 

m) Control system dynamics curve fitting and code conversion subroutines. 


Either microprocessor of the sensor service module will be 
capable of accomplishing the entire critical data handling task in the 
time allocated for critical functions. The minimum time for critical 
function measurement will be determined by: 

a) Resolution 

b) Tracking speed ‘requirements 

c) Accuracy requirements 

d) Number of functions designated critical 

e) Dynamic response of actuators. 

Figure 3.13 shows the redundant nature of the remote service module. 
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Each microprocessor will be capable of accepting test data and 
manipulative Instructions from the CP. Those data will be processed 
according to the specified instructions and the results made available 
to the CP for evaluation. The failure of any microprocessor to report 
correct results to the CP will result in that processor being removed 
from the task line-up or completely removed from the bus, depending 
on the nature of the failure. Any processor failure will be reported, 
by the CP to the pilot via an appropriate subsystem. 

Construction of the service module will be of such a design so as 
to allow the addition of sensors, signal conditioners and actuator control 
capabilities at a later time as the system is expanded. Provisions will 
also be Included to prevent the reconnection of sensors or actuators to 
incorrect channels during routine maintenance operations. 

Figure 3.14 shows the configuration of one section of the remote 
data service module. 
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Figure 3.14. 


One section of the remote service module. 
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The service module will: 


a) Operate on 14 or 28 volt supply. 

b) Be designed to operate under temperature, vibration and 
shock conditions expected in the part of the aircraft where 
mounted, 

c) Handle up to 64 serial bidirectional channels and up to 4 
parallel 8 bit input and output channels to the sensors and 
actuators. 

Each section of -the service module is Identical and consists' of: 

a) Serial data multiplexer 

b) Serial/parallel converter 

c) 8 bit parallel I/O ports 

d) Programmable pre-processor and communication controller 

e) Serial bus receiver transmitter system 

" Serial data multiplexer: The serial data multiplexer consists 

of a series of 8 - 1 bidirectional multiplexing switches connected in 
a 2-level configuration. (See figure 3.15). 

SERIAL DATA 



Figure 3.15. Serial data multiplexer. 
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The first 3 bits (0-2) of the serial data address port is applied to 
the first level of multiplexers. This results in the first level 
selection of "one of 8" channels for each of up to 8 multiplexers. 

Bits (3-5) of the serial address port is applied to the second level 
of multiplexers, which results in the selection "one of 8" of the 
first level selections. This serial data is then applied to the 
serial/parallel converter via the A-Mux SW. 

Serial to parallel converter: The use of VCO type A/D converting 

digital transducers provides a simple hardware approach to serial to 
parallel conversion, thus freeing the microprocessor for pre-processing 
and conmunlcatlon duties. The conversion timing will however be under 
control of the processor which will use time shared programming 
techniques. The serial data output, to stepping motor actuators, 
will also be in the microprocessors duty roster. Figure 3.16 shows the 
hardware portion of the serial to parallel conversion system. 


TO 

MULTIPLEXER 



'■Figur'e'iS. 16^!!iSerial to parallel converter hardware section. 
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The complement of bit 7 of the serial data address port is applied 
to the clear input of a binary counter. This action clears the counter 
when the port data is removed in order to address another channel. 

Bit 6 of the serial address is applied to two, bidirectional, solid 
state, single pole, double throw switches (A-Mux and -B-Mux, figure 3.16). 

This selects the direction of data flow (in or out of the system). In the 
case of incoming data (Q) , of the microprocessor, generates an enable pulse 
(through B-Mux SW - see figure 3.16) for a known time duration. Switch A 
will route data .to the counter input. At the end of the time window.. the 
number contained in the counter will represent the digital value of the 
analog transducer, located at the other end of the serial data channel. 

In the case of outgoing data to serial actuator, (i.e. stepper motor) 
the flag output (Q) will generate a specific number of pulses which will 
be routed through A-Mux SW and B-Mux SW by bit #6 of the serial address port. 

The programmable, microprocessor based pre-processor communication 
controller, and the receiver transmitter system will remain much the 
same as those in the ISP except for the number and type of I/O ports, 
programming packages and number of bus connections. Figure 3.17 shows 
a complete block diagram of one section of the remote station controller. 
Beyond those special features previously explained, the philosophy 
remains standard microprocessor technology. 
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Figure 3.17 One section of remote service module. 







Sens ors /Ac tuators 


Serial sensors: The relatively slow data rates of many.engir 

functions can be accommodated through the use of serial, multiplexed 
data being fed to the remote station pre-processor. "With economy, and 
simplicity of maintenance, in the foreground, the signal conditioners 
and A/D conversion should be an integral part of the transducer. Even 
though the final design of any transducer will remain the prerogative 
of the manufacturer, we propose a VCO concept with a variable frequency 
square wave output. (See figure 3.18), 
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CONTROLLED 




OSCILLATOR 
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Figure 3.18. VCO concept for A/D conversion. 


Published performance calculations suggest adequate performance 
of presently available equipment for 1% instrumentation if 100 KHz 
full scale VCO's with at most +.5% non-linearity are used. 

The sensors will be responsible for gathering data from all 
parts of the aircraft. These sensors will be identical for both engines 
of a twin engine aircraft, however some items may not be necessary in 
a less sophisticated aircraf.t system. All sensors and electronic 
equipment will be capable of withstanding shock and vibration consistent 
with the environment where located. State of the art solid state digital 
transducers will be employed except where they are not cost performance 
effective in the overall system. 

Pressure sensors : The pressure monitoring transducers will implement 

the following pressure- measurements : 

a) Oil pressure 

b) Vacuum 

c) Manifold pressure 

d) Fuex pressure (some systems) 

e) Barometric pressure 

f) RAM Air pressure 


44 


OHGiNALPAGE® 

OF QUALiril 




oil pressure. The engine oil pressure will be measured by a 
reliable stud mounted pressure transducer. The oil pressure 
transducer and associated conversion equipment will be so constructed 
to deliver pressure measurements to the system controller with the 
following accuracies; 

a) Pressure range - 0 - 50 kg/cm^ 

b) Pressure resolution - 1% of full scale or .5 kg/cm^ 

c) Dynamic resolution - must be able to track pressure changes 
of 2.5 kg/cm^/sec 

d) Accuracy - 1% of full scale 

Vacuum, The vacuum measurement system will consist of 
high reliability pressure transducer capable of vacuum measurements 
from 0 to 340 millibars. The vacuum transducer and associated 
signal conditioning electronics will be so constructed to provide 
an overall system resolution to .0173 kg/cm^, with an accuracy of .5%. 

Manifold pressure. The manifold pressure transducers will be 
consistent with the present state of the art and provide the following: 

a) Pressure range - 0-3.5 kg/cm^ 

b) Pressure resolution - .035 kg/cm^ 

c) Accuracy - 1% of full scale 

The manifold pressure transducers and associated electronics must 
track a dynamic change of at least 1.5 kg/cm^/sec. 


Fuel pressure. The fuel pressure transducer will be an integral 
part of any flight system which requires an auxiliary fuel pimip. The 
fuel pressure transducer will measure fuel pump performance and indicate 
fuel pressures to the following specifications: 

Range : 1.5 kg/ cm^ 

Resolution: .05 kg/cm^ 


Barometric pressure; The barometric pressure transducer will be 
a high reliability solid state unit capable of delivering measurements 
to the system controller with the following specifications: 

Range: .861 - 1.1055 kg/cm^ 

Resolution: . 000345 ’kg/ cm^ 

Accuracy: 1% of full scAe 

Any nonlinearity existing in the transducer will be compensated for by 

the preprocessing microprocessor through the use of curve fitting algorithms. 

RAM air. The RAM air pressure will be measured by a highly reliable 
pressure transducer. The RAM air pressure transducer will use approved 
state of the art methods to measure pressure over the required range. 
Transducer nonlinearity and inaccuracies will be compensated for by 
computer algorithms. 

Range; 0 - 300 nm/hr 
Resolution: 1 imi/hr 

Accuracy 1% of full scale 


45 



Temperature sensors: The temperature measurements will be consistent 

with good engineering practice and will use approved state of the art methods 
for measuring temperatures in the ranges specified. Transducer 
nonlinearity and inaccuracies due to environmental drift will be 
compensated for by computer algorithms rather than by hardware ' 
complexity. Individual' cylinder, gas, and head temperature 
measurements will be provided in order to do some engine diagnostic 
work in the CP. The following temperature measurements will be made: 

a) Exhaust gas 

b) Oil 

c) Cylinder head 

d) Carburetor throat air 

e) Thermocouple compensation junction temperature 

f) Outside air 

Exhaust gas temperature. The exhaust gas temperature will be 
monitored by reliable thermocouples attached to the exhaust manifold, 
as close as practical to each cylinder exhaust valve. The temperature 

and associated service electronics will produce measurements 
consistent with the following specifications : 

a) Temperature range ~ 0°- 1000°C 

b) Resolution - 10°C 

c) D 3 niamlc resolution - Unit must track changes at 25° C/ sec 

d) Accuracy - 1% of full scale 

Measurements will be provided on each Individual cylinder in order to 
provide some engine diagnostic capability by the CP.. 

Oil temperature. Oil temperature measurements w^li be made on 
each engine. 

a) Temperature range - 0°- 121°C 

b) Resolution - 1.2°C 

c) Dypamlc resolution - Unit will track cha5|es of 2.5 m/mln 

d) Accuracy - 1% of full scale W 

yf 

Cylinder head temperature. Engine cyliiider head temperature 
measurements will be made with reliable trSisducers mounted on each 
individual cylinder head. These transducers will deliver signals to the 
subsystem controller with the following specifications: 

a) Temperature range - 0°- 316°C 

b) Resolution - 5°C 

c) Accuracy - 1 % of full scale 

d) Dynamic resolution - the measurement system must be. able to 
track a dynamic change of 25°C/sec 

Carburetor throat temperature. The air temperature xd.ll be 
measured at the carburetor venturi to detect carburetor icing conditions. 

A solid state reliable silicon transducer will be mounted in the carburetor 
air passage which will enable the system to meet the following criteria: 

a) Temperature range - 0°- 65° C 

b) Resolution - 1°C 

c) Accuracy - 1 % of full scale 

d) Dynamic resolution - 30°C/sec 
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Outside air temperature; Outside air temperature will be measured 
by a highly reliable transducer. Current state of the art sensors will 
be used. The sensor will provide the following data; 

Range; -56°C to 70°C 

Resolution 5°C 

Accuracy ; 5% 

Liquid quantity sensors; The fuel flow rate/totalizing concept 
will be provided with a back up system of conventional t 3 rpe fluid level 
transducers mounted in each of the fuel tanks. These sensors will be 
reliable and calibrated to meet the following criteria; 

a) Level sensing range - 140 kg (wing), 140 kg (tip) 

b) Resolution - 10 kg 

c) Accuracy - 5% 

The system will provide at least one level sensor per gas tank. 

Orientation and angular rate; The autopilot in this system will 
be unrecognizable from a conventional autopilot standpoint. Sensitive 
position and/or rate gyros will be installed in the aircraft to detect 
the physical movement of the airframe in the pitch, roll and yaw axis. 

This information will then be pre-processed by the service module and 
passed on to the CP for final use in aircraft orientation actuator commands. • 

The data necessary for aircraft position decisions will require data 
in the following areas; 

a) Pitch axis d) Angie of attack 

b) Boll axis e) Compass -heading 

c) Yaw axis 

The sensors will represent present state of the art electronic transducers 
and be expected to meet the environmental conditions present at the point 
of Installalton in the aircraft. 

Position sensors: Orientation inf ormation- wi-l-l b& gathered using * 

the’ standard 3 rotational axis coordinate system with accuracies as follows: 

Roll position. Roll position will be obtained with 1% accuracy and 
provide data to display roll positions from (P to 359°. The roll position 
will be displayed to a resolution -of + one degree. 

Pitch position. The pitch axis specification will be identical to the roll 
position sensor: 1% accuracy, and will provide data to display pitch axis positions 

from 0°-359°. The pitch position will be displayed to a resolution of + 1®. • 

Yaw position. The yaw position specification will be Identical to 
the roll position sensor: 1% accuracy, provide data to display positions 

from 0 - 359°. Yaw position will be displayed to a resolution of + 1°. 

Angle of attack: The angle of attack sensor will provide information 

on the aircraft angle of attack with a range of -20° to +25° with a 
resolution of The overall accuracy will be + 1%. In addition the 

angle of attack sensor will be backed up with conventional stall warning 
sensors mounted on the leading edge of the wing. These sensors will be of 
the interrupt type. 
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•Compass. A remote sensing flux gate system will te used to accurately 
measure magnetic heading of the aircraft. The compass sensor will be 
.flight approved. Data collected by the sensor will be delivered to the . 
system controller. Any nonlinearity existing in the system will be 
compensated for. in the service module through the use of computer algorithms. 
The following data will be collected.. 

Range: 0^-359'’ 

Resolution: 1° 

Accuracy: 1% of full scale 

Dynamic resolution: The measurement system must be able to 'track 

+ 1 degree, given a dynamic change rate of 180^* /min 

Rate sensors: The system will be equipped with rate sensors in 
each engine compartment in addition to the system of rate gyros. 

Rate gyros. The rate gyros will be flight approved and will use 
state of the art design. The gyros will be positioned to measure 
rate of angular change about the roll, pitch and yaw axis. 

Roll rate. The roll rate will be determined to the following - 
specifications : 

a) Rate - 30° /sec 

b) Accuracy - 1% of full scale 

c) Resolution - + 1% of full scale 

Pitch rate. The pitch rate will have a maximum value of + 40P/sec 
with a resolution of + 1° and an accuracy of l%.of full scale. 

Yaw' rate. The yaw rate will have a maximum value of + 15® /sec, 
a resolution of + 1 degree and 1% accuracy 


Other rate sensors: Engine RPM. Engine RPM data will be 

obtained for each engine by an approved method and will represent 
the actual revolutions per minute of the engine. 

The transducer will be flight approved and will provide 
data to the following specifications: 

a) Range - 0 - 4500 RPM 

b) Resolution - 5 RPM 

c) Accuracy - 1% of full scale 

, d) Dynamic resolution - 100 RPM/sec . 

Voltage : The voltage sensing equipment will provide the monitoring 

subsystem with data to the following, specifications: 

a) Range: '5v - 32v 

b) Resolution: .25v 

c) Dynamic range: 2.5v/sec 

d) Accuracy: 1% of full scale 

The voltage sensing equipment will be able to provide accurate measurements 
even though the voltage is too low to power other equipment. The system 
will provide accurate measurements down to +5 volts. 
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Figure 3. 19 shows typical examples of serial engine monitoring applications 

using VCO technology. It is obviously assumed that all devices will be 

properly temperature stabilized and regulated to withstand power supply variations, 

temperature and vibration of the aircraft where the device is to be 

located. In the case of thermocouple applications a solid state 

temperature transducer would be used to measure the temperature of the 

reference frame. This information would then be used by the pre-processor 

to correct for the thermocouple characteristics. This eliminates the 

need for special reference junctions and other corrective hardware. 
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Figure 3.19, 


Examples of VCO technology in serial 
applications * 


engine monitoring 
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Tables 3.3 through 3.5 tabulate the serial input data assignments for 
each of the four remote stations. It should be noted that no serial input 
data assignments have been made to the tall mounted section because of its 
remoteness with regard to any serial transducer. With the exception of 
the tail mounted section, the monitoring assignments have been made, 
based on a balance of computer load rather than physical proximity of 
the function to the remote station. Further study may show it to be 
more desirable to reassign the measurement tasks to coincide with the 
physical location of the transducer relative to a remote station. Data 
from the tables show this to be completely feasible,- since the system 
is far from capacity at present. Figure 1.1 shows the relative position 
of each remote station within the aircraft. 


Table 3.3 Left engine compartment serial data tabulation 


Monitored Function Quantity 

1) Oil pressure — — — — l 

2) Oil temperature 1 

3) Exhaust gas temperature — 6 

4) Cylinder head ten5)erature 6 

5) RPM 1 

6) Fuel level 2 

7) Angle of attack — — 1 

8) Carburetor throat ten^jerature — 1 

9) Thermocouple reference temperature 1 

10) Aircraft battery voltage 1 

11) Fuel pressure — 1 

12) Manifold pressure 1 

Total 23 
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Table 3.4 Right engine compartment serial data tabulation. 


Monitored Function Quantity 

1) Oil pressure 1 

2) Oil temperature — 1 

3) Exhaust gas temperature — 6 

4) Cylinder head temperature 6 

5) 

6) Fuel level 2 

7) Fuel pressure — — i 

8) Manifold pressure 2 

9) Carburetor throat temperature 1 

10) Thermocouple reference temperature — — — 1 

Total ^ 22 


Table 3.5 Central located serial data tabulation. 


Monitored Function Quantity 


1) Yaw rate gyro — 1 

2) Two axis pitch-roll gyro — — — 2 

3) Two axis pitch-roll gyro 2 

4) Outside air temperature — — — — — — 1 

5) Humidity sensor 1 

6) RAM air pressure — 1 

7) Avionics bus voltage 1 

8) Angle of Attack 1 

Total 10 
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Parallel data Inputs. Because of conversion accuracy, speed - 

resolution or other special reasons, some measurements are more practical 
using conventional analog to digital conversion methods. (An example of 
this is shown in figure 3.20 and 3.21.) 

Current measurements: In order to provide power bus "current" 

measurements over a, sufficiently wide amplitude range and with enough 
resolution for equipment diagnostics, a standard successive approximation 
t}^e A/D converter is employed. The ' increased resolution will require 
more than 8 bits. Thus 2 parallel 8 bit input ports and double precision 
arithmetic programming is used in the pre-processor service module. 



BUS 

Figure 3.20. Power bus current measurements. 

Load currents, on the main power bus, will be used in a number of checklist 
operations . as well as for inflight performance evaluation measurements. 
Therefore, these measurements will be required to be more accurate and have 
greater resolution than would normally be required. Load variations under 
carefully controlled . situations will be monitored to determine; 

a) Condition of Nav lights f ) Preflight checkout 

.b) Compression ratio (at engine start) g) Engine diagnostics 

c) Proper operation of landing lights h) Inflight system functions 

d) Actuator operation i) Overall electrical performance 

e) Engine drag (at engine start) evaluation 

The following specifications will be in effect: 

a) Range: 0 - 60A 

b) Resolution: 100 ma 

c) Accuracy: 0.1% of full scale 
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Fuel flow rate: Another application that will require special 

attentlon^Hs the fuel totalization concept. In this application a 
dedicated hardware converter/ storage unit is necessary in order to 
maintain information while the service module is sampling other sensors. 
The essence of this concept is a dedicated tally of all fuel that flows 
in the line. Therefore, in order for data to be valid, no interruptions 
can be permitted. See figure 3.21. In this case the rotation of the 
turbine would be proportional to the fuel usage (a certain number of 
liters/revolution). 



SIGNAL 

CONDITIONER ' 


Figure 3.21. Fuel totalizer concept. 


A fuel flow transducer will be mounted in the fuel line feeding each 
engine. The transducer will be used in conjunction with a service 
module subroutine to act as a fuel totalizer. The total system including 
the fuel flow transducer will have the following specifications: 

a) Fuel flow range - 68 kg/ hr 

b) Resolution - 1.5 kg/hr 

c) Accuracy - + i% of full scale 

d) Dynamic resolution - 1.5 kg/ sec 
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Limit sensors ♦ It is anticipated that limit sensors, in the form 
of switch contacts, which- are activated at the limit of travel, or to 
indicate a function has happened, such as gear down and locked, will be 
grouped into blocks of 8 and applied to parallel inputs. The 
microprocessor will then search through the word and service the program 
subroutine which is appropriate to the data represented by each bit, 
while other serial data is being converted. 


iiroit sensors will be mounted on the controls or cables that 
are driven by the actuation system. These limit sensors can be solid 
state or mechanical and will be approved for flight. The limit sensors 
will meet the environmental conditions present at the point of 
installation in the aircraft, and will be mounted on the following items. 

a) Throttle e) Aileron 

b) Prop pitch actuator f) Elevator 

c) Mixture control g) Rudder 

d) Carb heat control h) Landing gear 


^ Parallel input data tabulation. Parallel data inputs will consist 
of contact closures or similar solid state single pole single throw 
or binary activity where on/off activity is accepted. Table 3.6 th 
through 3.9 shows the organization and load distribution of remote s 
stations with regard to parallel inputs. Typical usage would be 
limit switch and other end of travel sensors as well as binary 
output devices. ^ 


Table 3.6. Right engine compartment parallel input data tabulation. 


Bit // Function 


Port 

Quantity 



0 

1 

2 

3 

4 

5 

6 
7 


Flux gate open (low order byte) 1 


Flux gate (high order byte) 1 


Fuel flow 


Flap full up 
Flap full down 
Gear up 
Gear down 
Cowel flap open 
Cowel flap closed 




'I'o La I. 


4 
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Table 3.7 Left engine compartment parallel input data tabulation. 


Bit # Monitored Function 


Port 

Quantity 


0 

7 

0 

7 

0 

1 

2 

3 

4 

5 

6 
7 


Fuel flow (binary) 1 


Battery current 


1 


Cowel flap open 
Alerion full left 
Alerlon full right 
Trim full left 
Trim full right 
Gear .up and locked 
Gear down and locked\ 
Cowel flap closed 


Total 


1 


3 


Table 3,8 Central located parallel Input data tabulation. 


Bit # Function 


Port 

Quantity 


0 

7 

0 

7 

0 

1 

2 

3 

4 

5 
■6 
7 


Bus current (low order byte) 1 


Bus current (high order byte) 1 


Nose gear up and lock 
Nose gear down and lockJ 


Total 


3 
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Table 3.9 Tail mounted parallel input data tabulation. 


Bit # Function 


Port 

Quantity 


0 

1 

2 

3 

4 

5 

6 
7 

0 

1 

2 

3 

4 

5 

6 
7 


Elevator full up 
Elevator full down 
Elevator trim full up 
Elevator trim full downi 
Rudder full left 
Rudder full right 
Rudder trim full left 
Rudder trim- full right 




Static pressure 


Total 


J 


Actuators . Actuators are envisioned as digital stepping motors, 
or contact type actuators such as relays. Stepper motors will be coupled 
by magnetic gear driven clutches, to existing control systems. This 
provides a simple manual override capability. Linear actuators are 
therefore serviced by serial data channels, equipped with proper drivers. 
The engine and control surfaces will all have either automatic single 
actuator control with pilot mechanical backup, or will use strictly 
mechanical control which is prompted and sensed by the system. A single 
motor with magnetic clutches will provide all of the engine control , 
Independently "for each quadrant. Digital stepping motors will also 
be used on all control surfaces and the trim controls, but carburetor 
heat will be system prompted and pilot controlled. The magnetic clutch 
system provides a simple manual override capability and removes some 
of the stringency of the computer reliability. 

The service modules will be responsible for the positioning of 
all actuator controlled items in the aircraft. All actuators will use 
state of the art construction. A break away system will be provided 
for pilot override in case of failure. 
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A typical control surface action would be for the CP (via an 
autopilot subroutine) to calculate the amount of a control surface 
movement required. This Information would be converted to a specified 
number of square wave cycles by the remote service module and 
transmitted to the stepper motor. Data would then be re-read from the 
position sensors and be delivered back through the system to the CP. 
The autopilot would verify the movement and recalculate the subroutine 
until the degree of refinement required is reached. A list of items 
considered for automatic control, or prompting,- are as follows: 


a) 

Prop pitch control 

i) Aileron 

b) 

Carburetor heat 

j) Aileron trim 

c) 

Generator field 

k) Elevator 

d) 

Throttle 

1) Elevator trim 

e) 

Mixture 

m) Rudder 

f) 

Primer 

n) Rudder trim 

g) 

h) 

Fuel goost pump 
Mag switches 

o) Flaps ' 


Serial actuators . Prop pitch control: . The prop -pitch control 
will be actuated through a service module by a magnetic clutch and 
reversible motor. A mechanical -override scheme will be provided b 
by a break-away scheme in case of slip or clutch lock-up. 


Throttle; The throttles will be actuated through a magnetic clutch 
and reversible motor. 

Aileron: The aileron actuator will have the following specifications: 

a) Rate: 10^/sec 

b) Resolution: 1 degree 

,c) Position limits: +2^ — — — — 

Aileron trim: The aileron trim actuator will meet the following 

specifications : 

a) "Rate: 5 “/sec 

b) Resolution: 1 degree 

c) Position limits: +20“ 

Elevator: The elevator actuator will have the following 

specifications: 

a) Rater 10“/sec 

b) Resolution: 1 degree 

c) Position limits: 25® up - 15® down 
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Elevator trim: The elevator trim- actuator will meet the following 

specifications: 

a) Rate: 5° /sec 

b) Resolution: 1 degree 

c) Position limits: 26° up -30° down 

Rudder: The rudder actuator specifications are: 

a) Rate: 10° /sec 

b) Resolution: 1 degree 

c) Position limits: 32° left - 32® right 

Rudder trim: The rudder trim actuator specifications are; 

a) Rate: 5°/ sec 

b) Resolution: 1 degree 

c) Position limits: 9° left - 7° right 

Flaps : The flap actuator specifications are 

a) Rate; 5° /sec 

b) Resolution: 1 degree 

c) Position limits: 0° - 45° 

Mixture: The mixture control will be actuated through a magnetic 

clutch and reversible motor. 

Output data tabulation . Tables 3.10 through 3.13 show the serial 
data Actuator channels to be served by each station, while tables 3.14 
through 3.16 show bit assignments and type of data handling assignments 
for the parallel output channels. All serial outputs are envisioned 
as stepper motors provided with adequate drivers. 


Table 3.10 Left engine compartment serial actuator tabulation. 
Actuator Function Quantity 

1) Aileron trim left 1 

2) Aileron trim right — 1 

3) Cowel flap open 1 

4) Cowel flap closed 1 

5) Aileron left — 1 

6) Aileron right 1 

Total 6 
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Table 3.11 Right engine compartment serial actuator tabulation. 
Actuator Function Quantity 

1) Flap up 1 


2) Flap down 1 

3) Cowel flap open — 1 

4) Cowel flap closed = 1 

Total 4 


Table 3 » 12 Tall mounted serial actuator tabulation. 


Actuator Function Quantity 

1) Rudder left 1 

2) Rudder trim left 1 

3) Elevator up 1 

4) . Elevator trim up — — — 1 

5) Rudder right — 1 

6) Rudder trim right 1 

7) Elevator down 1 

8) Ele vator tr im d ow n — — 1 

Total 8 


Table -3J.3 Forward located serial actuator tabulation. 


Actuator Function Quantity 

1) Throttle quadrant 

stepping motor drive forward 1 

2) Throttle quadrant 

stepping motor drive reverse 1 

Total 2 
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Parallel driven contact type actuators ♦ The landing gear, fuel 
boost ptmp, primer and magneto switches will remain in an easily 
accessible position to the pilot. The pilot may be an active part of 
the actuator' system for the .use of these controls. But if the pilot- 
owner desires the above listen items to be actuator controlled’ the 
following specifications would be met. 

‘Landing gear: An FAA flight approved actuator to activate the existing 

gear system. 

Primer: A flight approved actuator to deliver a measured amount 

of gas to prime the engine. 

Magneto switches; An FAA flight approved actuator to turn on and 
off all magnetos. 

Fuel boost pump. The fuel boost pump will be actuated by on~6ff 
signals from the actuator service modules. The status of the boost pump 
will be monitored by the system. 

Carburetor heat; The carburetor heat control will be system prompted 
and pilot controlled. 

Generator field; Voltage regulation by generator field control will 
be accomplished in the normal manner. However provision will be made 
to switch out the generator field during .engine start-up. This will prevent 
power bus -voltage spikes during engine start. 


Parallel actuator data tabulation' . Tables 3.14 - 3.16 show 
bit assignments and type of data handling assignments for the parallel 
channels. All parallel outputs are considered to be of the on-off 
type requiring only a contact closure or single pole single throw solid 
state function for actuation. 


Table 3.14. Right engine compartment parallel actuator tabulation. 


Bit if Function 


Port 

Quantity 


0 

1 

2 

3 

4 

5 

6 
7 


Propeller de-ice switch 
Mag switches 

Electric primer, (carbureted 
Fuel boost pump 

Generator Field 


engine) 


3 




1 



Total 


1 
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Table 3.15. Left engine compartment parallel actuator tabulation. 


Bit # 


0 

1 

2 

3 

4 

5 

6 
7 


Function 


Fuel boost pump 

Mag switches 

Prop de-ice switch 

Electric primer (carbureted engine) 




Port 

Quantity 


— 1 


Total 

} 


1 


Table 3.16. Forward located parallel actuator tabulation. 


Bit # Function 


Port 

Quantity 


0 Prop pitch clutch Engine 1 

1 Prop pitch clutch Engine 2 

2 Throttle clutch Engine 1 

3 Throttle clutch Engine 2 

4 Mixture clutch Engine 1 

5 Mixture clutch Engine 2 

6 Landing gear up 

.7 , Landing_gear_down 



1 


Total 


1 


The tables include such items as carburetor air temperature for 
non- Injected, engines, other than the Cessna 402 IQ-520 engines, to show 
possible service locations. In addition, some items have been shifted 
from the closest positions to the sensor locations depicted in figure 1.2 
for more even processor program loading. If necessary, they could be 
shifted back to the closest remote station, since I/O connection capacity 
is far from saturated at any of the remote stations. 


61 



A typical system operating in a twin engine aircraft would, consist 
of four remote stations placed generally as shown in figure 3.22. Each 
station would vary in complexity depending on the number and type of 
data functions to be accommodated. Tables 3.17 through 3.20 show the 
component count, type and technology to be used by each remote station. 
Each remote station pre-processor, analog to digital converter and data 
controller will be dual and identical, therefore components required 
will vary only in the nvunber of parallel input and output ports and memory 
data multiplexers required by the type and number of data channels to . 
be serviced. 


Table 3.17. 

Left engine compartment remote station 

parts table. 

Quantity 

Type of Unit 

Technology 

2 

Differential Line Drivers 

Bipolar 

2 

Differential Line Receivers 

Bipolar 

2 

Hex Buffer Amp 

CMOS 

2 

Microprocessor CP (8 bit) 

CMOS 

2 

8K Read Only Memory (ROM) 

CMOS 

2 

2K Random Access Memory (RAM) 

CMOS 

2 

8 Stage Binary Counter 

CMOS 

2 

3-8 Decoders 

CMOS 

4 

2-1 Multiplexers 

CMOS 

2 

Crystal 


8 

Quad Nand/Nor 

CMOS 

4 

Latching Parallel Output Ports 

CMOS 

12 

Parallel Input Ports 

CMOS 

10 

8-1 Multiplexers (Analog) 

CMOS 


Table 3.18. 

Right engine compartment remote station parts table. 

Quantity 

Type of Unit 

Technology 

2 

Differential Line Drivers 

Bipolar 

2 

Differential Line Receiver 

Bipolar 

2 

Hex Buffer Amps 

CMOS 

2 

UART 

■ CMOS 

2 

Microprocessor CPS (8 bit) 

CMOS 

2 

2K Random Access Memory (RAM) 

CMOS 

2 

8K Read Only Memory (ROM) 

CMOS 

2 

8 Stage Binary Counter 

CMOS 

2 

3-8 Decoders CMOS 

CMOS 

4 

2-1 Multiplexer (analog) 

CMOS 

8 

Quad Nand/Nor 

CMOS 

4 

Parallel Latching Output Ports 

CMOS 

8 

Parallel Input Ports 

CMOS 

10 

Parallel Input Ports 

CMOS 


OF FOOK QXJALLT^ 
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Ta ble 3,19* Central remote station component count, type and technology 
Quantity Type of Unit Technology 


2 

Differential Line Drivers 

Bipolar 

2 

Differential Line Receivers 

Bipolar 

2 

Hex Buffer Amps 

CMOS 

2 

UART 

CMOS 

2 

Microprocessor CP (8 bit) 

CMOS 

2 

2K Random Access Memory (RAM) 

CMOS 

2 

8K Read Only Memory (ROM) 

CMOS 

2 

8 Stage Binary Counters 

CMOS 

2 

3-8 Decoders 

CMOS 

4 

2-1 Multiplexers (analog) 

CMOS 

2 

Crystal 


8 

Quad Nand/Nor 

CMOS 

4 

Parallel Latching Output Ports 

CMOS 

2 

Parallel Input Ports 

CMOS 

6 

8-1 Multiplexer 

CMOS 


Table 3.20. 

Tall mounted remote station component parts table. 


Type of Unit 

Technology 

2 

Differential Line Receivers 

Bipolar 

2 

Differential Line Drivers 

Bipolar 

2 

Hex Buffer Amp 

CMOS 

2 

DART 


2 

'Microprocessor CP (8 bit) 

CMOS 

2- 

IK Random Access Memory (RAM) 

CMOS 

2 

2K Read Only Memory (ROM) 

CMOS 

2 

8 Stage Binary Counter 

CMOS 

2 

3-8 Decoders 

CMOS 

4 

2-1 Multiplexers (analog) 

CMOS 

2 

Crystal 


8 

Quad Nand/Nor 

CMOS 

2 

Parallel Latching Outputs 

CMOS 

4 

Parallel Input Ports 

CMOS 

6 

8-1 Multiplexers 

CMOS 
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System Configuration Without the Remote Service Modules 

Typically the small single engine aircraft would provide the engxne 
compartment in a close physical proximity to the location of the integrated 
instrumentation package i In some cases this would make practical a 
configuration which requires no remote data gathering stations and thus 
all sensors and actuators interface directly with the integrated system 
package. See figure 3.23. 



BUS SYSTEM PACKAGE 


Figure 3.23. Sensor/ actuator system where no remote stations are required. 


This configuration takes advantage of the modular design feature and 
allows the degree of instrumentation required on a particular aircraft 
to be tailored to the budget of the owner and the sophistication of 
the aircraft. 

In this case the receiver transmitter units of figure 3.7 would 
be replaced by the serial to parallel converter section of figures 3.15 
and 3.16. Figure 3. ’24 shows the result. 

Placement of modules and components for a single engine aircraft 
is shown in figure 3.25. 
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single engine aircraft installation in minimum configuration. 
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DISPLAY SUBSYSTEM 


General 

An Advanced Avionics System configured for IFR operation will contain 
dual display subsystems. Physically one display assemply is located in front 
of the main system box, forming the front panel of the box. The second 
display is mounted in the panel space directly in front of the pilot. 

Each of the two units are functionally Independent with essentially 
identical capabilities. Each display has associated with it a set of 
dedicated push keys for pilot input. In addition, the panel face provides 
touch input to permit interactive tactile communication to the system. 

Plasma panel technology is designed into the present system. The plasma 
panel is commercially available, and proven. It provides high light 
output, ideal form factor, high reliability, and the potential for low 
cost. In addition, multi-color plasma panels have been demonstrated 
and may be developed in the future. Although a ntimber of alternate 
technologies were considered, we believe the plasma panel is the best 
all around choice at present. However, the modularity of the system 
is such that panels of widely divergent technologies can be used without 
affecting any of the other subsystems or design characteristics. 


Operational Features 

Dedicated key inputs . The display subsystem processor may be forced 
into any one of 10 special modes by activation of an appropriate "special 
function" key. Such action ultimately causes the insertion of a specified 
subroutine into the active job stream of the central processor. The 
special function modes are: 

1) Flight plan 

2) Pre-flight 

3) Start-up 

4) Frequency set 

5) Initialization 

6) Take off 

7) Enroute 

8) Landing 

9) Display modify 

10) System configuration 

Each of these categories can be activated by the pilot action of 
depressing a dedicated key at the display periphery. The key will Illuminate, 
and in most cases, remain active (l.e. "in") until repressed for release. 

In figure 2.1 these keys are illustrated as the horizontal row above the 
display panel. The keys are ordered from left to right in the sequence 
given above, providing a flow pattern typical of a flight sequence. The 
operational features of each is described later. 
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Interactive tactile inputs . The display panel also provides means 
for interactive tactile communication by a touch sensitive matrix on 
the panel surface. This feature may be built using several proven 
techniques , e . g . : 

a) A horizontal and vertical array of LEDs and photo sensitive 
transistors forming a grid parallel to the panel surface. 

A pair of light beams broken by a finger positioned on 'the 
panel identifies a set of "panel coordinates". 

b) Array of capacitive touch pads, deposited on the panel 
surface using a transparent conductor such as SnO. This 
technique is used by a number of appliance manufacturers. 

c) Ultrasonic surface wave generators and sensors along the 
glass periphery. The presence of a singer-touch causes 

wave reflection back to a receiver providing location Information. 

In the present design the LED approach has been, selected. 

The array has a resolution of +0.5 cm i.e. a touch-region shall 
have a basic size of 1 cm x 1 cm. 

Interactive display subroutines are to be capable of locating 
symbol boxes or alpha numeric queries at touch-pad coordinates. The 
pilot can then select between a plurality of options by touching the 
appropriate panel position. 


Functional Capabilities of Display Modes 

• Flight plan . General Features : The flight plan permits the pilot 

to define a flight path through Interactive use of stored data on the 
system’s magnetic tape mass memory. By pressing the "Flight Plan" 
dedicated key the system presents a display showing touch pads with 
selectable options. For example, an initial option might be: NEW or 
MODIFY. Selecting "NEW" will Initiate a process of entering flight 
path data via an. .interactive graphical map display. This process will 
-begin by a display showing an outline of the United States, blocked out 
into rectangular divisions associated with sectional chart areas. A 
representative diagram is shown in figure 3.26. Note that along the 
side of the display, a series of "touch boxes" are illustrated. Techniques 
of this type are to be employed for the definition of input data. 
Operationally, new flight planning might follow a sequence block diagram 
as shown in figure 3.27. Detail map formats are shown in figure 3.28. 

Following insertion of destination data, the "Flight Plan" algorithm 
shall present the pilot with an interactive sequence of queries and 
response options to obtain additional flight data. For example, 
cllmb-to and cruise altitudes can be requested, weight and balance 
computations carried out, etc. Flight planning is terminated whenever 
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Figure 3.26. Flight planning initial map .display 
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the special function key is released. All data entered and or assembled 
during the activity are maintained In system memory. Altering an 
originally prepared plan is accomplished by re-presslng the "Flight 
Plan" key and following the appropriate interactive sequence. 

Display map size and resolution: 

a) U.S. Map with Sectional Box Overlay. The map will be displayed 
over a 18 cm by 13 cm panel region. This permits the scale 
size of each sectional box to be approximately 2 cm x 1 cm 

and therefore compatible with touch pad resolution. Some 
distortion of the actual U.S. map and sectional relative positions 
is necessary to create alignment with touch pad areas. 

b) Sectional Map Display. Each sectional map covers an area 
approximately 350 nautical miles by 250 nautical miles. 
Displaying this over a panel region of 7 in by ‘5 in results 
in a 1/2 in square touch pad resolution of 25 nm. square. 

c) 50 Mile Square, High Resolution Map. The final enlarged map 
section will' be displayed over a 10 cm by 10 cm panel area. 

■ . At this. scale, a 1 cm touch pad covers a mapped surface 

5 miles square. It is possible that in high density areas two 
airports may be unresolvable within a touch pad region. To 
provide for this contingency, the "Flight Plan" subroutines 
can carry out either of the following: 

1. Automatically, expand the scale one more time to present 
a 5 mile region on the 10 cm x 10 cm display surface- 
This will give touch pad resolution of 0.5 nm. 

2. Print a list of the redundant facilities with selection 
touch boxes and permit the pilot to select one of the 
list by touch. 

Preflight . The preflight option when selected provides the pilot 
with a checklist of activities which should be completed before entering 
the Start Up mode. In addition it can provide him with the ability to 
enter or check parameters such as time of day for the system check, etc. 

In addition to listed manual activities for pilot completion, the system 
initiates a series of automatic preflight checks. All lights are 
checked for satisfactory current. All actuators are cycled to stops 
and back. Gyros are powered up and outputs checked. All sensor outputs 
are checked for valid ‘outputs. Any discrepancy located during these 
activities is reported to the pilot via an alpha nimeric message on 
the display panel and an aural warning. Release of the PFLT buttom 
removes this algorithm from the CP job stream. 
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Start-up . Upon pushing this switch the right third of the display 
is formatted with a check list of pre-start tasks. These involve boost 
pump actuation, fuel pressure, throttle and mixture settings, etc. 

After the pilot accomplishes each task listed, the corresponding 
box is touched. It is displayed "colored in" and the process continues 
until the list is all checked off. After this list is completed the 
start-up algorithm shall display a cue s imi lar to "ENGAGE RIGHT STARTER". 
During the cranking phase, starter current is measured to determine such 
things as compression and frictional drag. As the engine catches, 
parameters such as oil and fuel pressure are monitored. Any abnormalities 
will be reported to the pilot via a blinking alpha-numeric message. 

The pilot shall have the option of maintaining a display of all or 
selected portions of the engine parameters. These include; 

Oil temperature CKT 

Oil pressure Manifold pressure 

Fuel pressure and/or flow RPM 

Charge current Fuel quantity 

Bus output voltage 

A typical arrangement for such a display is shown in figure 3.30. 

Scale factors will be such that all "green range" values fall within a 
DLirked horizontal band. Out of nominal parameters are easily recognized 

visually. However, constant monitor of all parameters by the CP will 

trigger pilot awareness should green region limits be exceeded. 

In normal operation this display would be relegated to the center 
section panel. 

Frequency set . Default frequency display;^ Before^ we. detail the- - 
sjjecific .action- of- the -FREQ- SET fuhc'tibn it is convenient to describe 
default modes of frequency display and alteration. A standard display 
of all frequency or code selectable devices will automatically occur 
whenever the Takeoff, Enroute, or Landing functions are Involved. 

This display will be based on "function" rather than "device". That 
is, frequencies will be given for Ground Control, Departure Delivery, 
Tower, etc. rather than identified with particular subsystems such as 
COM 1, COM 2, etc. A typical display to be presented during an ENROUTE 
phase of flight is shown in figure 3.29. 



Figure 3.29. 
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Example of default frequency display during enroute. 
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Figure 3.30. Example Engine Data Display, 





The numbers shown in boxes are frequencies which the system CP recognizes 
for possible communications tasks. The CP will assign frequencies to 
these boxes based on information obtained from the map data stored in 
mass memory. Pilot alteration of any unassigned or previously assigned 
frequencies is easily carried out. By simply punching the new frequency 
or code on the numeric keyboard the result is displayed in the ENTER 
box seen in figure 3.30. Visual and audio correlation confirm the 
result. If punched incorrectly it can be cleared and re-entered. Once 
the ENTER box contains the correct number, it is transferred to the 
appropriate function, e.g. UNICOM, simply by touching the UNICOM frequency 
box. 


The boxes to the left of the function list specify pilot assigned 
activity. The double box around "CENTER” Indicates the pilot has selected 
center as the "priority function. In the event that two signals are 
received simultaneously, the priority signal is acknowledged by the audio 
subsystem and is the only one heard. The figure Illustrates reception 
of center and FSS signals and transmission on the FSS channel. With 
two COMM subsystem cards up to two functions can be in the receiving 
mode simultaneously. An Installation might have three or four COMM 
subsystems if desired. Transmission can occur on only one channel at 
a time. The pilot selects the desired configuration by touching the 
appropriate box on the display. Those selected are colored in for 
ready identification. Touching an uncolored receive box transfers the 
non-priority receive assignment, FSS in this case, to the touched position 
function box. A reassignment of the priority attribute can be made 
by sequentially touching the "P" box and the desired function. 

Frequency set options; By engaging the "Frequency Set" the pilot 
has the option of frequency assignment based on actual subsystem component. 
Thus he will be presented with a list which includes: 


COMM 1 


COMM 2 


OMNI lA 


B 


C 


DME 1 A 
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OMNI 2A 
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Note that the nav units have three associated frequency boxes 
each. The A box Is assumed to have first priority. The subsystems 
sequence through these three frequencies in certain modes. Entry of 
a specific frequency is accomplished as previously. The frequency,- 
or transponder code, is keyed in at the keyboard then transferred to 
the unit by touching the appropriate box. 

An accompanying list of potentially selectable frequencies identified 
by the CP will also be displayed in this mode. 

Initialization . The initialization mode provides options and 
input modes for setting data into the system. Examples include time, 
barometric pressure, w'ind velocity and direction, temperature, dew 
point,- etc. Some of these are normally computed by the system. However, 
failures in transducers or remote stations might mitigate pilot input. 

In essence this mode provides a catch all capability to carry out any' 
parameter initialization required by any of the subsystems. 

Take Off, Enroute, Landing . These modes when activated by, pilot 
actuation of the . respective switches forces the system to use certain 
subroutine tasks characteristic of that particular mission phase. In 
general, the system software is to be designed so that automatic transition 
from one to the other takes place. For example, after pilot actuation 
of Take Off, the system presents maps of runway layout, then departure 
plate. When computed position is at edge of departure plate, the 
system automatically switches to enroute mode with appropriate map 
changes and frequency assignments. (The system can not unilaterally 
remote or change a "priority" frequency) . A similar automatic mode 
change would occur when computed aircraft position is within the 
distances associated with the approach plate of the destination airport. 

However, there are numerous situations where the pilot desires to 
operate in a particular mode irrespective of the CP's evaluation. In 
such a case, the .mode button fully depressed lock's in position. It 
remains activated until fully pressed again. 

i * 

The switches of these three modes are designed to have two actuating 
conditions. If pushed to a first detent, the mode is selected but when 
the. switch is released the mode contact returns open. In such a situation 
the mode selected is maintained until the CP detects conditions which 
dictate an automatic change. Under such conditions the mode can be 
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altered by the CP* If the switch is pushed past the first detent to 
a full limit, a lock mechanism holds the switch in. It remains there 
until a second hard push which results in release. As long as the switch 
is "on”, the system is forced to maintain the mode specified. 

An exception to the previous condition is that a system reconfigure 
input can override the switch input. Thus a switch release failure 
can be circumvented. 

Display modify . In this mode the pilot has options provided of 
formatting the display panel differently than the default options. 

This may be necessary if a partial panel failure occurs. Alternatively, 
under certain mission conditions he may desire the display of special 
information not normally presented. The flexibility and options afforded 
in this mode are a function of the software package designed for its 
operation* 

In addition to Display Modify the system provides an alternate means 
of repositioning display contents on the surface. This is made available 
through the Special Purpose Keypad. A swap key provides for interchange 
of left half and right half panel data. Altema'tlvely the display can 
be shoved up and down or left and right. Thus any partial display 
failure can be mitigated by moving the desired segment to an operating 
portion of the screen* 

System configuration . Under certain conditions it may be desirable 
to force certain subsystems into specific state. For example assume the 
DME fails and for some reason, automatic correction of mode is not 
made. The pilot can reconfigure Nav 1 to operate in mode 1 to continue 
in providing area nav output using multiple VOK information. Or perhaps 
he choses to leave his original flight. -path^ and*^ desires to fiy an OMNI 
radial -to ■ a certain 'station. He therefore desires to force Nav 2 into 
mode 12 and add a "radial track" display format to the system. This 
can be done via the System Configuration mode. 

As with the Display Configuration, the flexibility of the mode depends 
on the ingenuity with which the software is written. However, this mode 
provides the vehicle by which a wide range of innovative activities can 
be offered to the pilot. Most emergency situations call for some form 
of system reconfiguration. Such actions are handled via this mode. 


Map Displays 

All maps will normally be displayed in a square format covering a 
display region 10 cm x 10 cm. On take off this region will typically 
contain a departure plate* During enroute a sectional type chart will 
be displayed. During landing an approach chart (both plan and elevation 
views) are available. 


y 
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During enroute phases, the map will cover a region of approximately 
80 km square* All maps shall be heading up, moving map format in default 
mode* Alternate modes shall be available via Display Configure. 

The map shall display: 

a) Cities, as square boxes with abreviated names. 

b) Radio towers and call letter symbols. 

c) Airports 

1) with facilities but turf runways' 

2) with facilities and hard surfaced runways 

3) no facilities, turf 

4) no facilities, hard surfaced. 

d) Directional beacons with call letters. 

e) Omnis with call letters. 

f) Restricted zones. 

g) Large bodies of water. 

The ^ilot can obtain detailed information about any element displayed 
on the map by touching the appropriate element symbol. For example, 
touching an airport symbol will cause a display of information in alpha- 
numeric form of location, elevation, runways, tower, approach and ground 
control frequencies, or unicorn, etc. This information will be automatically 
located in a blank portion of the display panel, typically the lower left 
corner. An option will also be presented on the display to define this 
airport as the flight destination. In such a case, subsequent activation 
of the "LANDING” function would result in landing graphics of this , 
rather than the originally "FLIGHT PLAN"ed destination, airport to be 
presented. 


Display Memory Requirements 

Bulk data storage . Bulk memory is required for storing all map 
related data. Data shall be coded to provide positional accuracies of 
+0.2 km. All cities with a population equal to or greater than 2,500 
shall be included. In addition, data shall be provided for all navigation 
facilities (omni, nondirectional beacons, etc.), all antennas identified 
on sectionals, all pnblic use airports, all restricted areas, large bodies 
of water, and high point elevation in a 30 km square region. It is possible 
that major highways, rivers, and railroad tracks might be included. 

An estimate of the bit capacity required to store this data, not 
including railroads, rivers and highways, has been made. Based on this 
estimate a storage capacity of 15 x 10^ bits shall be required by this 
system. Thus storage is actually a part of the Bulk Memory subsystem. 

It is included here only for reference. 


78 



ROM . ROM memory is required for display system programming and 
symbol storage. Alpha-numerics will be organized on a basis of a 5x7 
or 7x9 dot matrix. Most other symbols can similarly be organized into 
an arrangement of this type. Estimates of program storage requirements 
are difficult to define. However, based on extrapolations from other 
graphics systems, we feel confident that 8,000 words at 8 bits, i.e. 
64,000 bits will be sufficient. 

RAM . The total RAM requirements for the flat panel display system 
are estimated at 2,000 words at 8 bits, i.e. 16,000 bits. 


General Hardware Considerations 


The basic display subsystem block diagram is shown in figure 3. 31 
Physically, the CPU, ROM, RAM, Interface chips, and BIMs are mounted 
on the main subsystem printed circuit card. This card plugs into the 
488 bus system via the BIM bus interface moduals. The Flat Plate Display, 
Tactile Inputs, and Keyboard are assembled together as a unit which 
is mounted on the aircraft panel. See figure 2.1. 

There are a number of state-of-the-art microprocessors which’can 
be used for this subsystem. The Motorola 6800 is used in a similar 
application by Tektronlcs in their 4051 graphics terminal. The 
block diagram of figure 28 uses the terminology of the Rockwell PPS-8. 

This particular microprocessor- is favored here because of the flexible 
I/O provided by the standard PDC (Parallel Data Controller) as well as 
the microprocessor's large instruction set. 

Best estimates on memory size are a R0M_ of 8K kbytes .and- RAM- of - - - 
2K'byte’s.” Using today' s" techno logy the RAM would require 1 package, 
e.g. , the Texas Instruments TMS-4070 dynamic MOS device. The ROM at 
64 k bits would require 4 packages. A t3^ical device for this task is 
the INTEL 2316A organized as 2048 words, 8 bits/word. Total subsystem 
package count for the main PC board complement is therefore: 

BIM 2 

CPU 1 

ROM 4 

RAM 1 

DMAC 1 

PDC 4 

GPKD 1 

CLOCK 1 

Total 15 


?9 
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Total power dissipation will be in the vicinity of 7 watts. A board 
5" X 10" will provide 3.3 in^/device. This is a quite reasonable number. 
Figured another way, the total integrated package area is approximately 
7.5 in^. For a PC board of 50 In^, the ratio of total area to package 
area is greater than 6.5 to 1. Again a quite conservative result is 
obtained. It therefore appears reasonable to assume that the display 
processor proper can be assembled on a single system card. Flat flexible 
cables from the PDC's and KBI will be routed directly from the board 
to the remote display package without intermediate connectors. 

Microprocessor System . The microprocessor chosen for this initial 
design is tO' be the Rockwell PPS-8. All I/O units are designed to be 
directly compatible with no level shifting, or additional power supplies. 
DMA.C is necessary for receiving ’ large blocks of data from the CPS for 
map display. The overall system is quite typical and requires no unusual 
parts or gimmicks. 

Display Panel Hardware . The panel mounted assembly is to be built 
around an Owens-Illinois Digiview plasma flat plat dot matrix display. 
Mounting is to be performed with a molded bezel, so that the actual 
panel is tilted back at the top. The upper portion of the plasma panel 
is thus recessed into the aircraft instrument panel surface. An angle 
of 30 degrees from normal will be used in the first model. All driver/ 
decoder circuits will be fabricated from SSI T^L chips plus discrete 
chip devices for the high voltage direct panel drive. Thick hybrid 
technology will be used. A block diagram of the remote part of the 
display subsystem is shown in figure 3.32. 

Flat panel display x-lines are to be split to provide in essence 
an independent pair of panels each 256 x 256. Decoder-driver . circuits • 
are partitioned to maintain- fehi-S' independence. An electronics failure 
in a driver or PDC channel shall riot cause complete loss of display 
capability. The same is to be true of in~panel failures such as 
line-line shorts or line opens. 

LED-Phototransistor pairs will be used for tactile sensing. These 
shall form a grid of 20 x 10 intersections. This provides a resolution 
of 1.25 X 1.25 cm, (i.e. .5 in x .5 in) on a 25 cm x 12 cm display. The 
tactile s6nsor-encoder outputs are connected to the processor via a 
PDC modual. 

The key Inputs consist of ten dedicated function keys plus a numeric 
key set of 10 numerals and a decimal point. Additional keys "clear" and 
"clear entry" are also included. 

A high voltage inverter type power supply is to be part of the 
associated electronics mounted with the display panel. Requirements 
for an off-the-shelf plasma panel are: 

+5 V + 1% @ 3.75 amp 
+7 V + 30%@ 2.0 amp 
+75V + -.5%@- ; 175 amp 

+95V + .* 5%@ . 7 amp 
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Figure 3*32. Display subsystem panel mounted units* 
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Decode /Drive 



The power supply shall be constructed on a CP board and mounted parallel 
to and behind the actual plasma panel. It is split into two parts to 
maintain redundance. Decode 1 drive circuits contain registers inter- 
connected with the special keypad to permit swapping of left and right 
panel half display. In addition wrap-around slow capability is also 
incorporated. 

The panel to be used will be the Owens-Illinois Model 512/256-52.6. 
This panel has a viewing area of 24.71 cm by 12.34 cm. The total outside 
glass dimensions are 32.54 cm by 21.17 cm. Thickness is 1.22 cm, not 
counting the fill tube which extends 3 cm above the back surface. 

The display panel, associated power supplies, and addressing 
electronics will be assembled in a manner similar to the sketch of 
figure 333. Large dimensional extension due to connectors is eliminated 
by use of flat-flexible circuits and an elastomer connector strip. These 
flex circuits provide electrical connection to the display lines, 
photo transistors and LEDs, Wrapped over the edge, and connected to 
the back mounted PC boards, these connections add less than one millimeter 
to the outside dimensions. 

Function switches and the keyboard are to be mounted in 
the outer display bezel which provides the unifying structure and 
facilitates mounting to the aircraft. Outputs from the switches and 
keyboard will be wired to a small PC board parallel mounted behind the 
keyboard. Flat flexible circuits will then be used to connect from here 
to the main subsystem card in the system box. 

All keys are approximately 1 cm by 1 cm and shall require a firm 
applied force for actuation. The Function keys, i.e. the 
horizontal row along th^ display paiml_toj),_shall be Internally lighted. 

- This' provides 'unequivocal "identification of which functions are active. 


System Software ’ 

The electronics aspects of the display subsystem are all relatively 
straight forward. It is the software package which requires careful 
design and reasonable sophistication. Obviously detailed design of such 
a package can not be done here, however the general structure is outlined 
sufficiently for such work to follow. 

Software will be structured as shown in figure 334. The descriptions 
following are meant to be primarily generic with the understanding that 
detail design problems may mitigate some restructuring. 

EXEC Software . The EXEC is the main software program. It calls 
all the other programs as subroutines. The EXEC performs all communication 
tasks with the rest of the system via the BIM. In addition it recognizes 
pilot input through Interrupts generated by tactile or special function 
key actuation. Input data from the General Purpose Keyboard and Display 
Module is managed by the EXEC. 
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Figure 3.33. Display panel assembly. 
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Figure 3.34. Display subsystem software structure. 
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Supervisors ♦ There are two supervisory first level subroutines. 

One has control over display functions , the other over pilot input . 

Pilot Input Supervisory has the task of decoding events initiated by the . 
pilot, then going to appropriate second level subroutines which generate 
appropriate messages and required destinations. The Display Supervisor 
is responsible for reaction to commands from HIM to create a new display-, 
image. It must also relay any required response back through the EXEC 
to the BIM for transmission. 

Second Level Subroutines . 

Display Function - Compartmentalized into segments by display 
function, e.g. Vertical Situation, Enroute Map, Approach Map, 

■Way Point, etc. Each compartment is a set of instructions 
required to organize the actual transmission of data. 

Symbol Generation - Essentially a table- of coordinates, with respect 
to symbol center, of each dot in a particular symbol. Each 
symbol used must, be stored here, e.g., all alphas, .all numerals, 
airports, towers, horizontal bar. 

Format - A set of subroutines which keeps track of reference 

coordinates of each display function with respect to absolute 
display reference. Contains default formats for- different flight 
regimes, i.e. enroute, approach, etc. 

Scaling - Subroutines to perform the functions of expansion, 

. reduction, shift, rotation, windowing, etc. 

The basic subsystem sequences fall into three general classes: . 

a) Pilot Initiated Input (Tactile or Key) 

b) Update Existing Portion of Display 

c) Reconfigure Display 

Given below are several scenarios which illustrate the various subroutine 
responsibilities . 

1) Start-Up ; 

1) BIM receives message from a CPS to clear flat .panel 

a) Exec carried out decoding of message, and activates 
Display Supervisory subroutine. 

b) Supervisory creates appropriate output commands using linked 
subroutines. Output byte stream passed directly to display 
to clear each display dot one at a time. 

c) Result - all dark panel. 


ORIGINAL PAGE IS 
OP POOR QUALITY 


86 



2) Pilot Pushes Flight Plan Switch 

1) Exec identified interrupt, decides when to respond. 

2) Control passed through Pilot Input Supearvisory to Keyboard 
Subroutine where command "Flight Plan" is decoded. 

3) Message sent through BIM to CPS which causes "Flight Plan" 
to be Introduced to JOB TABLE and appropriate priorities 
to be established. 

4) CPS requests "Flight Plan Options" display. Transmitted 
through BIM, EXEC, to DISPLAY SUPERVISORY. Control is passed 
to FPO function subroutine which uses Symbol Generation and 
Format to define "ON" display dots. These "ON!' dots are 
activated sequentially by the Supervisory output. Format 
Coordinates are transmitted via BIM to CPS . 

5) Pilot touches panel at "NEW" location. EXEC recognizes Interrupt 
and activates the "Tactile" subroutine. The coordinates of the 
tactile input are determined and transmitted via BIM to the CPS. 

6) CPS correlates tactile coordinates with known format-fcoordinates, 
activates "NEW" subroutine. 

7) CPS. requests "Sectional Selection" and "Waypoint" displays, 
via BIM. No format coordinates specified. 

8) Display Supervisory sets up displays requested using default 
format coordinates. 


3) Display Update 

1) CPS attitude algorithm determines aircraft is in climbing 
right turn, i.e. horizon is below center 10 deg and rotated 
left 30 deg. 

2) Multibyte message sent to display subsystem carrying the 
Information: 

CCCC = Code for Vertical Situation Display 
HHHH = Code for Horizon Symbol 

XXXX YYYY = Coordinates of Symbol Center with respect to 
VSD zero reference 

6000 = Rotation angle of horizon symbol 

3) Display Supervisory uses FUNCTION, SYMBOL GENERATION, and 
SCALING to create new bit pattern which is transmitted to 
display. 
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These examples give conceptual insight into the design of the 
actual software. Detail design will be a large task, and in fact 
constitutes the largest component of effort in the display subsystem. 

The software package must include the capability of transmitting 
portions of ROM to the main CPS. This block is to be the main system 
code for system calculations. Thus the display subsystem shall send 
upon request the central processor programs which in turn control the 
subsystem. This provides for flexibility of operations with essentially 
any central processor subsystem. 
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NAVIGATION SUBSYSTEM DESIGN 


Introduction 

General s The system is designed to have two independent navigation 
subsystems. The following are representative of individual subsystem 
techniques . 

a) VOR-^DME, VOR-VOR, DME-DME 

b) OMEGA 

c) Navstar GPS 

d) LORAN C 

e) VOR-ADF, ADF-ADF, VOR-VOR 

It is anticipated that within the near future, VOR-VOR, and VOR-DME 
will remain the primary radio navigation aids. However, OMEGA is 
presently operational and provides a viable alternative or second option. 
NAVSTAR will be critically evaluated by the general aviation community 
during the next five years. It will probably turn out to be a cost 
effective and reliable technique. LORAN C is touted by many, but it 
remains to be seen if the government will be willing to invest the money 
for the required number of ground stations. Techniques b, c, and d 
above require similar computational capabilities. Omega requires the 
least expensive RF hardware, but is the least accurate. 

For the present system, inclusion of VOR-DME, and VOR-ADF 
subsystems is anticipated. However, the basic system structure and 
operation is completely independent of which techniques are ultimately 
selected by the individual aircraft owner. 

Functional capability . Any navigational subsystem shall have the 
capability of replying to a query with a computed lattitude-longitude 
coordinate pair. Thus each unit, addressable as a navigation subsystem, 
must include: 

a) RF electronics compatible with the navigational technique 

employed. 

b) Built in computer to: 

1. Control RF electronics 

2. Garry out latitude and longitude computations 

3. Handle device-interface functions communications 

c) Bus Interface Module for transferring data to and from the 
. subsystem. 
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Data Transfer Capabilities. For the present the following inodes 
shall be defined for navigation subsystems: 

Mode Number 

0 

1 

2 

3 

4 

5 

6 

7 

8 

9-13 

14 

15 

It is recognized that the FAA is officially moving towards an area 
navigation route structure. Thus for the near future, at least one of 
the two navigation subsystems for an IFR aircraft will use some version 
of VOR-DME area navigation. The other navigation subsystem could be 
another IFR area navigation subsystem or some other nav system 
using ADF, VOR, etc. In this system design a VOR-DME subsystem has 
been chosen to provide both versatility and redundancy for the IFR 
enroute and approach tasks and a VOR-ADF combination is used as a 
low cost alternative subsystem. 


May. Technique 

Dead Reckoning 

VOR-VOR 

VOR-DME 

DME-DME 

ADF-VOR 

ADF-ADF 

OMEGA 

LORAN C 

NAVSTAR 

PRESENTLY UNDEFINED, 
available for future expansion 
ILS 
IDLE 


Navigation Subsystem # 1 

Navigation subsystem # 1 will consist of two separate RF subunits, 
each capable of independent operation. The subsystem proposed in this 
report will use a combination of OMNI and DME. 

Algorithms are designed to return latitude-longitude to the central 
processor system under normal conditions. However, modes exist where 
conventional omni radial or straight DME distance is returned. Thus if 
a situation exists in which insufficient data is available for reliable 
latitude-longitude calculations, the pilot has an option of being given 
the basic data. It should be pointed out that latitude-longitude 
computations are always possible, however. The subunits are designed 
to employ a Kalman filter which uses air data, plus whatever can be 
obtained via nav. aids. In the absence of all nav. aid data, the 
Kalman algorithm will continue to provide latitude-longitude 
estimates, based on air data and best estimates of wind. As presently 
envisioned, a full complement of data in a VOR, DME subsystem will 
include : 
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VOR radials from three independent stations 

DME slant distances from each of the three above 

Corrected air speed 

Corrected magnetic heading 

Altitude 

If three acceptable signals from three stations can not be received, 
two will be used. Finally, one can still provide a complete data 
set. Should the VOR subunit fail, DME data alone can be used. 
Similarly VOR radial data alone can be used if the DME subunit falls. 

One significance of latitude-longitude navigation output is that 
the main system computers have the same information to work with 
regardless of the specific navigation technology being used. Thus 
we no longer talk of an omni subsystem or DME subsystem, or OMEGA 
subsystem. Rather, we talk of a NAV subsystem. The technology 
used depends on the manufacturer, and permits optimum cost 
effectiveness. 

A block diagram of the NAV subsystem is shown in figure 3.35. In 
this design RF subunit 1 is a multiplexing OMNI and subunit 2 is 
a multiplexing DME. The subsystem is highly redundant in that it 
contains two essentially independent subunits, each one alone being 
capable of providing latitude-longitude. Either subunit processor 
can act as a bus communicator and mutual checking of results allows 
local error detection. 

OMNI subunit . The OMNI subunit is a multiplexed frequency 
receiver-processor capable of calculating radials from three separate 
stations. By using these data in a Kalman filter, latitude-longitude 
can be computed. 

The algorithmic techniques for computing VOR outputs and the 
hardware Implementation of those techniques is, to our knowledge, 
original to SIU/CAC. 


The VOR radial measuring algorithm makes use of a Fourier transform 
digital filter. This eliminates any time and temperature varying passive 
or active- filters with attendant phase shift errors. The basic 
concept is described with reference to figure 3.36. 

Output from the I-F section goes to a demodulator circuit which 
detects, and delivers to two separate outpins, the 30 Hz reference 
phase, and the 30 Hz variable phase signals. These two 30 Hz signals 
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Figure 3.35. Nav subsystem block diagram. 
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are simultaneously sampled and the results held for analysis. Since 
these signals are to be sampled, low pass filtering is necessary. Thus 
a pair of 90 Hz, 3 Pole Chebyshev passive filters are added between 
demodulation and S/H. The signals can therefore be sampled at 200 Hz. 

The effects of mismatch in these filters will be discussed later. 

Sampling the two filtered 30 Hz signals for 5 complete cycles 
at 8 samples per cycle, l.e. fs = 240 Hz, accumulates 40 samples for 
each signal. The period between sampling events is approximately 

4 m sec. The A/D MUX must therefore operate at 2 m sec intervals 
to deliver each signal s^ple to the A/D for conversion before the 

next sampling time. The 10 bit A/D must therefore perform the conversion 
in less than 2 m sec. This of course is well within range of nearly 
all commercial devices. 

In approximately 165 m sec, data can be collected from one. station. 

It is to be analyzed as follows : 

1) Modify raw data with a Hanning windowing function or equivalent. 

(80 multiplications 80 additions) 

2) Using simple Discrete Fourier Transform (DFT) algorithm to compute 
the 30 Hz component of each signal. Both magnitude and phase. 

(160 multiplications 160 additions) 

3) From the analysis of (2), determine the relative phase of one 
signal with respect to the other. Perform any corrections 

on the result. This is the radial. 

(6 multiplications 10 additions) 

From the above, it can be estimated that the computation of a radial 
requires a ^^av^ 1 nllTn of 246 multiplications and 250 additions. Assuming 
a binary multiplication requires 16 machine cycles and a binary addition 
takes one machine cycle, the total problem requires approximately 4200 
cycles. Assume 5000 to allow for addressing, fetching etc. Using a 

5 u sec machine, we find a radial computation can be performed in 

approximately 25 m sec. Thus the entire process of collecting data for 

5 periods and computing the radial can be accomplished in less than 
200 m sec . By sequencing the frequency synthesizer through three 
stations, three radials can be computed in 600 m sec and latitude- 
longitude determined. 

Consider now the effect of the 90 Hz band limiting filters 
following the demodulator. Assuming the filter is fabricated from 
thick film resistors and chip capacitors, it is apparent that + 20% 
tolerances, the normal as-fabricated range, could result in a phase 
differential significantly in excess of the desired + 2 degree error . 
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Two obvious solutions exist. First, the filters can be trimmed after 
fabrication to provide zero differential phase shift. A second 
alternative Is to include in the system a built in test signal with 
which the system could measure Inherent differential phase and subtract 
the offset from its computed radial. The latter option is preferred 
here. Perhaps in practice a combination of both would be economically 
feasible. The block diagram of figure 3. 37. shows the test circuit and 
analog multiplexer required to carry out the internal differential 
phase offset. 

Definition of Individual block specifications . A block diagram 
of the VOR subsystem is shovm in figure 3.37. The follox^ing discussion 
relates to this figure. 

RP-IF Subunit: This subunit is to be Incorporated into the 

navigation antenna base. All electronics can be fabricated using thick 
film hybrid techniques into two packages. Detector output is to be 
coupled to the coax center conductor via a 15 kHz low pass filter. The 
local oscillator signal is coupled out from the cable through a high 
pass filter. Local AGC shall provide + 3 db output variation for 
signal strength ranging from 10 uv to 100,000 uv. Varactor tuning, 
or equivalent, will be used to tune the EF amplifier based on a 
frequency to voltage converter monitoring the synthesizer frequency. 

FM-AM Demodulator. The omni demodulator receives as input the 
superimposed 30 Hz and 10 kHz base band signal via the low pass filter. 
Reference phase demodulation is accomplished by a phase locked loop 
detector. The amplitude modulation is recovered by filtering. < Amplifi- 
cation as needed to obtain signals in the 1 to 5 volt level shall be 
incorporated in the demodulator block. Each 30 Hz output signal is delivered 
to a separate package pin. This block will be fabricated in hybrid 
technology in single package. 

Localizer Filter: The localizer filter block shall contain 90 Hs 

and 150 Hz amplifier-filter combinations. Channel bandwidth for each 
shall be 5 Hz at -3 dB and less than 60 Hz at -40 dB. Output voltage 
of the 90 Hz and 150 Hz signals shall be between 1 and 5 volts with 
a center-line equivalent simulated signal. Amplitude imbalance introduced 
by the filter network shall be less than 2%. 

Frequency Synthesizer: The frequency synthesizer shall use a 

digital input phase locked loop design. It shall provide local oscillator 
for the RF mixer so as to provide 200 channels between 108.0 and 118.0 
mHz and 100 IcHz steps. Frequency stability and harmonic content shall 
be consistent with present standards. 

Level Detect: The level detect circuit shall provide a logical 

level output corresponding to the signal delivered from the RF subunit. 

Any signal greater than 500 mv out of the AM demodulator output port 
shall produce a logical 1. Software to check this parameter at each 
computation cycle shall be included in the microprocessor algorithms. 

Pilot warnings shall be provided to advise of unusable signal strength. 
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Test: The test Modual and its accompanying analog MUX shall 

be capable of providing two 30 Hz + 1 Hz signals 180 degrees out of 
phase. Actuation of the MUX and gating on the oscillator shall be 
under control of the microprocessor. A simple transistor or dif-amp 
circuit can be used to obtain these signals with a highly accurate 
phase relationship. 

Microprocessor: The microprocessor shall have a basic cycle time 

equal or less than five microseconds. A CMOS unit is 
preferable with first priority going to the RCA COSMAC in a ceramic 
package. Five I/O ports, DMA, 16K bits of ROM and 4K bits of RAM 
should be sufficient to perform the required tasks. The software 
package shall contain the DME algorithms so that the OMNI computer 
can perform ADF functions in case of' ADF microprocessor or memory 
failure. 

Glide Slope . Glide slope reception is accomplished by a completely 
separate RF/Detector front end. This electronics subgroup is located 
at the GS antenna base. The glide slope signal is used only at short 
distances from the transmitter. Hence, the receiver complexity is rather 
low. Power, frequency S 3 mthesizer output, and the 90/150 Hz detected 
signal are all transmitted along a common coaxial cable. Output from 
the glide slope detector is multiplexed with the localizer output into 
a common 90/150 filter circuit. During the approach phase of aircraft 
operation the microprocessor actuates the MUX alternately computing 
V 90 /V 150 ratios from the glide slope and localizer. Such ratios are 
then used to compute angular deviation from the center line. This 
information is available for transmission, via the BIM, to the central 
processor subsystem. 

The frequency synthesizer for the glide slope is designed to use 
the same 8 bit output code sent to the localizer, and generate the 
appropriate local oscillator signal for the receiver. This circuit 
uses a phase-locked-loop and frequency multiplier chain to generate 
the required input signal. 

The UHF RF amplifier is an FET broad band amplifier. Amplifier 
gain change is less than + 3 dB over the entire glide slope band with 
no variable tuning. The RF amplifier and mlxer-filter-detector circuit 
are to be fabricated in lybrid form in no more than two separate packages. 

DME Subunit . General Features: The DME subunit is similar in 

overall structure to present discrete receivers. However, the functions 
of signal lock and range .calculation are carried out via software programs. 
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This reduces package count and results in a lower power, higher reliability 
subunit than would be possible with a discrete SSI, MSI approach* A 
block diagram of the subunit is shown in figure 338* The RF section 
both transmitter and receiver, are located remotely at the antenna* 

Dual channel coax couples dc power, transmitter rf , mixer LO, and 
pulses between subunits* The circulator shown in the left coax delivers 
transmitter sync pulses to the modulator, and received return pulses 
back to the processor* 

The key modual in the subunit is the "Controller”. This is a 
high speed microcontroller operating via program sequence to drive 
the transmitter and evaluate the receiver response* A typical commercial 
unit for this modual is the SMS Microcontroller. Operating at a 
300 n sec cycle time, this device can easily sample return pulses at 
a resolution corresponding 'to 0*2 km. The controller carries out 
transmitter initiation, return pulse identification, range lock, and 
timing measurements. It communicates to the microprocessor the 
measurement results, then awaits a command to continue with another 
measurement sequence. 

The microprocessor performs the functions of: 

1) Specifying Frequency to the Synthesizer 

2) Computing latitude-longitude based on data from the controller 
and through DMA with the OMNI subunit using a Kalman filter 
algorithm 

3) Communicating with CP via the BIMs 

4) Performing self check and cross check with OMNI subunit 

Since testing is not critical, a relatively slow unit can be used for 
this task. It must provide D^ to RAM as shown in figure 3.35* However, 
no other esoteric features are required. 

Transmitter: The transmitter shall be an all solid state device 

modual, comparable to the most recent commercial designs* Output power 
will be equal to or greater than 400 watts PEP* Output, circuits are 
broadly tuned to eliminate any electrically controlled tracking. 

Frequency synthesizer output shall be mixed and multiplied as required 
to obtain the required output range. 

Pulse modulator: The pulse modulator is simply a pulse amplifier 

designed to take logic level signals from the controller and pulse the 
final stages of the transmitter. Pulse position and duration will be 
established by the controller. 

The modulator will be constructed in thick film hybrid from using 
standard bipolar discrete transistors, diodes, SCRs and logic chips. 

It shall also provide the control signal to operate the T/R switch. 
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. Figure- 3. 38 Block diagram of DME subsystem with marker beacon.;. 
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Receiver Section: The receiver shall be a single conversion 

pulse-CW type heterodyne detector. No RF anq)lifier is used, but broad 
band passive filtering and antenna matching shall be incorporated. 

The receiver can be constructed in a single hybrid package. However, 
it is likely that two separate packages provide a more optimum 
manufacturing arrangement. The first package will contain the T/R 
switch, mixer and first IF amplifier. An IF frequency of 60 mHz 
is realistic for this application. Standard bipolar communication 
SSI IC devices are applicable with a 60 mHz IF, Mixing can be performed 
with diodes. 

The second receiver module will contain up to five additional 
IF amplifier steps. The Motorola MC 1550 cascade amplifier IC is 
an example of a typically applicable device for this circuit. 

Envelope detection and filtering plus AGC generation and distribution 
will be included within the package. Inductors required for 
network can be mounted external to the hybrid package. 

Output for the detector/filter portion is transmitted to the 
controller via the circulator, coax configuration shown in figure 3.38. 

' Frequency Synthesizer: The frequency synthesizer shall be a phase 

locked loop digitally controlled design. It shall be capable of providing 
transmitter and receiver LO. Transistion from one output to another 
shall be possible within 30 u sec. It shall be capable of producing 
400 frequencies to transmit and receive on the designated 200 channels 
linked to standard VOR frequencies. It is possible of course to design 
transmitter and receiver to use the same synthesizer output for a given 
channel. However, greater design flexibility is afforded if the synthesizer 
is capable of producing separate transmitter and LO frequencies for a 
common channel. Specific frequencies will be determined during actual 
hardware design. 

Microcontroller: The microcontroller has been previously discussed 

in general. It shall operate under program control according to a 
flow diagram typical of that shown in figure 3.39. The controller stands 
initially in an idle. loop until a logical 1 level (GO) is supplied 
by the microprocessor. At such a time as the GO signal is *'l", and as 
long as it stays "1" the controller will loop through its measurements 
loop. At step 2, the processor delivers to the modulator the two 
pulse transmit sequence. This sequence is two pulses of three microseconds 
duration spaced 12 microseconds. At step 3 a delay of D microseconds' 
occurs while waiting for the return pulse pair. D is set initially to 
25 microseconds and adjusted as required by subsequent algorithms. 

At step 4, detector output samples are taken at 1 microsecond internals 
and stored into consecutive bit locations of three 8-bit words. The 
resulting pattern is thus a 24 microsecond san 5 )le of receiver output, 
delayed D microseconds after the transmitted pulse pair. 
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At step 5 the resulting bit pattern is scanned to determine if: 

a) A valid return pulse pair in in the bit sequence 

b) A pair exists how far it is shifted from center 

Step 6 uses this information to make a decision as to whether or not 
a locked condition exists. Such a decision is based on statistics of 
previous trial results, pattern shift within the sample etc. The results 
from this block are: 


a) Lock state Indication 

b) Computed change in Delay D for next trial (may be zero) 

c) Transmission of appropriate data to the microprocessor 

The increment of D as specified by step 6 is checked against maximum 
and minimum limits, and the flow returns to the beginning to carry 
out the sequence again. Total pass time through the loop should take 
no more than 1 mllllsecohd. This is too fast for normal DME operation. 
Hence the microprocessor will control when the process is repeated. 

Microprocessor: The microprocessor complex will contain a single 

chip CPU, clock, bus controller circuitry. In addition it must have 
256 X 8 RAM with DMA, and IK of 8 bit ROM for program store. It must 
have a minimum of 12 bits output to service the frequency synthesizer, 

8 bits out and 8 bits in to service the controller, and 8 bits out and 
8 bits in for each of two BIMs. A CMOS unit is desirable such as the 
IM6100 or COSMAC, however, low cost and minimum chip count are of 
prior importance. In this respect the new Motorola 6875 may be a 
more desirable candidate. 


The software shall be capable of directing sequential frequency 
changes over three channels specified by the CP. The channels used must be 
identical to those used by the OMNI if both radial and distance data 
is to be used by the Kalman filter. The channels do not however need 
to be scanned simultaneously. Software algorithms shall be capable of 
operating in the following modes: 


Mode Output 


Methods 


0 

1 

2 

3 

12 

13 

14 


Latitude-Longitude 

Latitude-Longitude 

Latitude-Longitude 

Latitude-Longitude 

Raw Data 

Raw Data 

Localizer 


Dead Reckoning 
Radial Only 
Radial-DME Distance 
DME Distance Only 
Radial Only 
DME Distance Only 


Marker Beacon: The marker beacon RF front end is a self contained 
TRF receiver. The audio output is coupled onto the transmission coax 
through a low pass filter which provides isolation from the frequency 
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Table 3.2-1. DME Subsystem Parts Table. 


Package 

Count 

Function 

Technology 

Complexity 


1 

T/R, Mixer , 1st IF 

Hybrid 

4 chip , 20 

passive 

1 

4 IF, Detector, AGC 

Hybrid 

'6 chip , 38 

passive 

1 

Transmitter 

Hybrid 

5 chip , 30 

passive 

1 

Modulator, Circulator 

Hybrid 

4 chip, 20 

passive 

1 

Frequency synthesizer 

Hybrid 

7 chip, 38 

passive 

3 

Controller, ROM, I/O 

Bipolar 

LSI 


1 

Amplitude detect, Audio Amp 

Hybrid 

3 chip, 20 

passive 

1 

Marker beacon RF & Detect 

Hybrid 

4 chip, 26 

passive 

8 

Microprocessor, ROM, RAM, 





DMA, I/O • 

MOS 

LSI 


1 

BIM 

Hybrid 

10 chip, 32 

passive 

1 


PC Board 



2 

Connectors 

Coax 
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Table 3.22. 


Omni Subun i t Parts Table 


Package 

Count 

Function 

. Technology 

Complexity 

Antenna 

Remote Unit 



1 

Antenna 

Mechanical Unit 


1 

RF Amp, Mix. , Freq/Volt 

Hybrid 

7 chip, 35 passive 

1 

IF Amp, Detector 

Hybrid 

6, chip, 50 passive 

1 

Filter 

Ceramic 


1 

Connector 

Coaxial 


1 


PC Board 


Glode Slope Remote Unit 



1 

Antenna 

Mechanical Unit 


1 

RF Amp 

Hybrid 

3 chip, 18 passive 

1 

Mixer, Detector, Amp 

Hybrid 

3 chip, 24 passive 

1 

Connector 

Coax 


-1 


PC Board 


Main System Card Unit 



1 

UHF Frequency Synth. 

Hybrid 

8 chip, 30 passive 

1 

VHF Frequency Synth. 

Hybrid 

6 chip, 24 passive 

3 

I/O units 

MOS 

LSI 

1 

ROM' 

MOS 

LSI 

1 

RAM 

MOS 

LSI 

1 

DMA 

MOS 

LSI 

1 

Microprocessor 

MOS 

LSI 

1 

A/D, S/H, MUX 

Hybrid 

5 chip, 10 passive 

1 

m/m Demod. , MUX, Test 

Hybrid 

'9 chip, 36 passive 

1 

LOC/GS Filter, MUX 

Hybrid 

5 chip, 10 passive 

1 

Audio, Level Detector 

Hybrid 

4 chip, 24 passive 

1 - 

Connector 

Coax 


1 


PC Board 
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synthesizer output. The entire remote marker beacon subunit will be 
assembled on a thick film hybrid circuit using an integrated circuit 
chip such as the National IMi71» Simple diode envelope detection and 
RC filtering will be used to provide the audio output. 

The marker beacon subunit on the subsystem board recovers the 
audio from the coax through a low pass filter. Contained within this 
unit are: 

a) An audio amplifier capable of delivering the 400 Hz outer 
marker modulation to the audio unit at a power output of, 

100 m watt. 

b) Peak rectifier and level detector to identify station crossing. 
The output from the level detector will operate an interrupt 

of the microprocessor to signal activation of a localizer 
subroutine. This subroutine will send data to the display 
under CP control to create a localizer tick on the approach map. 


Navigation Subsystem // 2 

A block diagram of the NAV subsystem # 2 is shown in figure 3,40 
In this design RF subunit 1 is a multiplexing OMNI and subunit 2 is 
a multiplexing ADF. The subsystem is highly redundant in that it contains 
two essen’^ally independent subunits, each one alone being capable of 
providing latitude-longitude. Either subunit processor can act as a 
bus communicator and mutual checking of results allows local error 
detection. 

Processor requirements . Each processor shall have sufficient 
capacity to carry out the processing algorithms for its subunit at 
an update rate of 1 sec. In addition it shall be capable- of the 
following: 

1) A Kalman filter algorithm using true air speed, and true 
magnetic heading. Wind velocity and direction, and aircraft 
position .shall also be computed. 

2) An algorithm to compare computed latitude-longitude at time 
ti with the Kalman filter projection from data at ti_i and 
provide a decision on the validity of the new data. It shall 
carry out such an analysis on its own latitude-longitude 
calculations and those of the other subsystem processor. The 
basic data is available to both processors via the DMA^ function. 
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Figure 3.40. Nav subsystem block diagram. 
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3) An algorithm shall provide for communication between processors 
to determine which is to be bus communicator. 

ADF subunit . General Features: The ADF block diagram is shown 

in figure 3. 41* 


One of the important features of this circuit is that no mechanical 
loop or goniometer motion is required. The elimination of all mechanically 
moving parts iS' a key step in achieving high reliability. Additionally 
all RF amplification is done right at the antenna with no intervening 
coaxial cable to cause signal loss. Thus high signal to noise ratios 
are possible at low signal amplitudes. , This results in. longer range. 

With the techniques proposed a common high gain narrow band RF and IF 
module is used for all signals. 

The basic algorithm is described with the help of figure 3.42. The 
four channel analog MUX is connected to Gnd^ sense, loop 1 and loop 2 
respectively. The grounded input is to provide synchronization between 
the remotely multiplexed signals and processing electronics. Each 
signal is sampled for 100 u sec, providing a series of approximately 
20 periods of the 455kHz IF signal. 

Three pieces of information are necessary to determine station 
bearing. They are: 

a) Ratio of signal amplitude from loop 1 to loop 2. Thus ,, 

6 - tan“^ \ 

^ |Vl2| ^ 

where 0 is an angle between 0" and 90“ , is, the signal 
amplitude for loop 1, and for -loop 2. 

b) Phase angle 0 between V^i and Vl 2> where 0 = O^’or 180“ . 

If 0 = 0“then the station bearing is either B ~ 9 or 
B‘= 0 + 180“ ♦ If 0 = 180“ then the station bearing is 
either B = 0 + 90“or B = 0 - 90“. 

c) Phase angle ip between and the sense signal Vs. This angle 
again is either ip = 0° or ij; = 180®. It resolves the ambiguity 
associated with (b) . 

These relationships are foirmalized by the following: 


Given 0 = 





[Vli- 

L 

\ 

|Vl2 
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Figure 3.41. ABF subunit block 





















AGC Product' Det. 

Voltage ^ Output ^ ^ Sense 



Figure 3.42 ADF System Signals - The figure shows that the loop 1 and 

sense signals are In phase while loop 1 and loop' 2 are 180° 
out of phase. 
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The bearing angle B’ is given as; 


0/ll) 

0° 

180° 

0 

0 

0+180° 

180 

0+90° 

CD 

I 

o 

o 


The parameters are computed from data available to the u Processor 
at different times in the four step sequence. During- steps 1 and 2 
the output of the product detector is- 0 and this is used to 
synchronize the computation process. At time step 3 the inputs to 
the product detector are the sense signal, coming from the delay circuit, 
and the loop 1 signal. Thus if i|^=0°the product detector has a positive 
output voltage, if i/;=180'’ the output is negative. These two levels 
are converted to logic levels and sensed by the microprocessor. 

Similarly at time step 4 the phase detector Inputs are from loop 1, 
coming out of the delay, and loop 2. The output in this case gives 
the value of 0. In addition to 0 and being determined, the loop 
signal amplitudes are also measured at time steps 3 and 4. These 
are obtained by measuring the I/F AGC voltage. 

Thus all necessary parameters are available in 200 u sec with 
a 200 u sec dead space to carry out the computations. In this system, 
a frequency scan algorithm shall be incorporated so that a new ADF 
channel will be selected and bearing to that station determined in a 
similar manner. Continuing through as many as three stations, the 
results are fed to the Kalman filter which then determines position 
with respect to the stations. Based on actual latitude . longitude of 
the stations, geographical position of the aircraft may be determined. 

Under conditions where the geometrical relations yield an 
indeterminate solution, projection of position based on the Kalman 
filter dead reckoning can be used. The algirithm can use data from 
one OMNI station obtained from the other subunit. If only a. single 
ADF station is within reception range and no OMNI data is available, 
a highly unlikely situation, the subunit shall be capable of providing 
"directlon-to-station" data typical of present ADF systems. 

Interactions with main computer subsystem . CPS to ADF: The main 

central processor shall determine the location of up to five ADF 
transmitters within a normal 25 mile radius. If more than three are 
available from which to choose, selection will be based on geometrical 
considerations. Based on this determination the CPS shall send the 
frequency, latitude-longitude, and priority associated with these five 
stations. The priority will be used by the ADF processor to set up 
the frequency synthesizer sequence. Thus the initial three 
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tried will be priorities 1,2 and 3. If one station is out or signal 
strength too low then 1, 2 and 4 or 1, 2 and 5 will be tried. Periodic 
checking shall- be carried out to return toal, 2, 3orl, 3, 4 priority 
when possible. In addition a mode code shall be sent to the ADF subunit 
to determine the basis of its algorithmic computations. These are 
identif ied as : 


Mode Code- 

0 

4 

5 
15 

ADr-CPS: The ADF shall be 

following : 


Algorithm 
■Dead Reckoning 
- ADF-VOR 
ADF-ADF 
IDLE 

capable of sending to the CPS the 


a) . Self-^test status word. 

b) Latitude and longitude of computed position. 

This shall- be sent in four consecutive 8 bit words. The>. 
first word will transmit the degree, latitude, the second 
seconds latitude. The second two words are similar for 
longitude data. . Since only five bits are required for 
"seconds" data, the three remaining bits of these words 
may be used for other purposes. Latitude and longitude 
seconds shall be reported at + 1 sec. 

•c) Bearing angle to station. 

This shall be sent as two 8 bit words with the angle sent 
in integrals of + 1 degree. The first. words will contain 
the 8 least significant bits and the second remaining 
most significant bit. This bit shall be in the LSB position 
of the second word. The remaining 7 bits may be used for 
other purposes. 

ADF individual block specifications . RF front end: The analog 

MUX, RF amplifier and mixer shall be constructed in thick film hybrid 
technology in a single package. Essentially five chips plus perhaps 10 
capacitors, 10 resistors and 4 external coils are required. The stage 
shall have a maximum gain of 40 dB. The circuit shall be electrically 
tuned from a voltage derived by a frequency to voltage converter sampling 
the mixer local oscillator signal. Input frequency range shall cover 
200 kHz to 1,600 kHz. Because of the wide frequency spread simple 
varactor tuning will not be feasible. Rather an active Miller 
capacitor modulator or functionally equivalent circuit will be 
necessary. 

IF-AGC; The IF circuit shall provide a maximtmi gain of .60 dB. 

Two separate AGC's are specified, one of fast response and one slow. 
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In implementation it may be possible to use one detector amplifier 
circuit with two separate filters. The fast time constant AGC must 
respond with a rise time, of 3 ess than 10 cycles at the IF frequency 
so that it provides an accurate measure of loop ! and loop -2 voltages 
during the sampling intervals. However, a slow AGC must be used during 
sense signal time in order to be able to extract the audio modulation. 
Thus the slow AGC is to have a- time, constant long with respect to the 
low frequency audio. These two AGC signals are multiplexed to the IF 
and RF stages in' synchronism with the RF input MUX so that during sample 
time 1 and 2 the long time constant AGC is active and during times 3 
and 4 the short time constant AGC is active. 

ADF microprocessor . The- basic computational flow diagram to be 
carried out by -the microprocessor is shown below. 



Figure 3.44. ADF controller flow diagram. 
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With the timing proposed there is approximately 350 u sec to compute 
bearing angle from raw data and in 1050 u sec, bearing to three stations is ' 
determined. Following this triple traverse around the flow loop 
transmission out is accomplished to compute latitude longitude and take 
care of any communication tasks. Assuming there are 600 instructions 
required for the computation and 100 for error checking etc., then even 
using a slow machine at 5 u sec/ instruct ion average this requires only 
3.5 m sec. There is obviously plenty of time to complete a new position 
calculation once per second. We conclude that a very minimal microprocessor 
is required. 

Frequency Synthesizer . The frequency synthesizer shall be fed a 
single 16 bit word through two output ports simultaneously which encodes 
the desired received frequency from 200 kHz to 1,600 kHz in 1 kHz steps. 

The frequency synthesizer shall use phase-lock-loop techniques to produce 
the appropriate mixer. Using a 455 kHz IF the frequency range of the 
VCO will be 40 kHz £ f 1145 kHz. 

A/D AGC converter . The AGO A/D converter shall have an ‘8 bit 
resolution. It can probably be best implemented using a commercial 
8 bit LSI unit operating at approximately a 1 MHz internal clock. Thus 
8 u sec would be required to do the conversion, a quite reasonable 
time in light of the other subunit parameters. 

Product detector . The product detector shall provide input signal 
filters, actual product detection and logical output coding. 

Filtering of the sampled signal coming from the delay circuits 
will be encessary for reconstruction. Whether this is done prior to 
the detector or incorporated into the detector circuit makes no difference. 
However, any significant phase shift so introduced must be also added 
to the other input also. In addition, depending on the type of detector 
used, any required 90 degree phase shifts shall be considered as part 
of the Product Detector block. 

Output from the detector shall be in the form of a two bit logic 
level code: 

One or both inputs 0 00 

Inputs in phase 01 

Inputs 180 deg out of phase- 10 

Analog delay circuit . The analog delay circuit shall provide an 
output replica of the input signal at a delay of N/f jp where f jj. is 
the center frequency of the IF amplifier. Assuming N=50 and 
ff-455 kHz, the total delay is approximately 110 u sec. It is to be 
noted that the output is used only to determine a relative phase shift 
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of 0° or 180°. An analog measure of relative phase Is not required, 
hence errors in delay time are of no consequence to correct performance. 

With present state of the art the delay can easily be obtained 
by use of a CCD LSI delay line. A tj^ical example is the Fairchild 
CCD321m device connected as a 455 bit analog shift register. Post 
amplification and clock drive circuits are a part of this block. 

Insertion loss of the total delay shall be nore more than 3 dB. 

Audio output block: The audio output block shall detect the 

sense sampled and provide audio output at a 100 m watt level to the 
audio subsystem Output frequency response shall be limited to 200 Hz 
toj 2 kHz. An internal IDENT filter having a notch at 1 Hlz to reduce 
the code audio by at least 20 dB. 

BIM. The microprocessor shall have individual output/lriput ports 
dedicated to each of two BIMs. These must have tri-state outputs 
so as to share the BIM with the VOR microprocessor. 

OMNI subunit . The OMNI subunit is a multiplexed frequency switchable 
receiver-processor capable of calculating radials from three separate 
stations. By using this data in a Kalman filter latitude-longitude 
position can be computed. 

The algorithmic techniques for computing VOR outputs and the 
hardware implementation of those techniques is, to our knowledge, 
original to SIU/CAC. 


The VOR radial measuring algorithm makes use of a Fourier transform 
digital filter. This eliminates any time and temperature varying passive 
or active filters with attendant phase shift errors. The basic 
concept is described reference to figure 3.45. 

Output from the I-F section goes to a demodulator circuit which 
detects, and delivers to two separate outpins, the 30 Hz reference 
phase, and the 30 Hz variable phase signals. These two 30 Hz signals 
are simultaneously sampled and the results held for analysis. Since 
these signals are to be sampled, low pass filtering is necessary. Thus 
a pair of 90 Hz, 3 pole Chebyshev passive filters are added between 
demodulation and S/H. The signals can therefore be sampled at 200 Hz. 

The effects of mismatch in these filters will be discussed later. 

Sampling the two filtered 30 Hz signals for 5 complete cycles 
at 8 samples per cycle, i.e. fs = 240 Hz, accumulates 40 samples for 
each signal. The period between sampling events is approximately 
4 m sec. The A/D MUX must therefore operate at 2 m sec intervals 
to deliver each signal sample to the A/D for conversion before the 
next sampling time. The 10 bit A/D must therefore perform the conversion 
in less than 2 m sec. This of course is well within range of nearly 
all 10 bit commercial devices. 
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In approximately 165 m sec, data can be collected from one station. 

It is to be analyzed as follows: 

1) Modify raw data with a Hanning windowing function or equivalent. 

(80 multiplications 80 additions) 

2) Use simple Discrete Fourier Transform (DFT) algorithm to compute 
the 30 hz component of each signal. Both magnitude and phase. 

(160 multiplications 160 additions) 

3) From the analysis of (2) , determine the relative phase of one 
signal with respect to the other. Perform any corrections 
on the result. This is the radial. 

(6 multiplications 10 additions) 

From Che above, it can be estimated that the computation of a radial 
requires a maximum of 246 multiplications and 250 additions. Assuming 
a binary multiplication requires 16 machine cycles and a binary addition 
takes one machine cycle, the total problem requires approximately 4200 
cycles. Assume 5000 to allow for addressing, fetching etc. Using a 
5 m sec machine, we find a radial computation can be performed in 
approximately 25 m sec. Thus the entire process of collecting data 
for 5 periods and computing the radial can be accomplished in less than 
200 m sec. By sequencing the frequency synthesizer through three stations , 
three radials can be computed in 600 m sec and latitude longitude 
determined. 

Consider now the effect of the 90 Hz band limiting filters 
following the democulator. Assuming the filter is fabricated from 
thick film resistors and chip capacitors, it is ‘apparent that + 20% 
tolerances, the normal as fabricated range, could result in a phase 
differential significantly in excess of the desired + 2 degree error. 

Two obvious solutions exist. First, the filters can be trimmed after 
fabrication to provide zero differential phase shift. A second 
alternative is to include in the system a built in test signal with 
which the system could measure inherent differential phase and subtract 
the offset from its computed radial. The latter option is preferred 
here. Perhaps in practice a combination of both would be econimically 
feasible. The block diagram of figure 3.46 shows the test circuit and 
analog multiplexer required to carry out the internal differential 
phase offset. 

Definition of individual block specifications: ‘ a block diagram 
of the VOR subsystem is shown in figure 3.46. The following discussion 
relates to this figure. 

RF-IF subunit; This subunit is to be incorporated into the 
navigation antenna base. All electronics can be fabricated using thick 
film hybrid techniques into two packages. Detector output is to be 
coupled to the coax center conductor via a 15 kHz low pass f^Llter. The 
local oscillator signal is coupled out from the cable through a high 
pass filter. Local AGO shall provide + 3 dB output variation for 
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signal strength ranging from 10 uV to 100,000 uV, Varactor tuning, 
or equivalent, will be used to tune the EP amplifier based on a frequency 
to voltage converter monitoring the synthesizer frequency* 

FM-AM Demodulator: The omni demodulator receives as input the 

superimposed 30 Hz and 10 kHz base band signal via the low pass filter* 
Reference phase demodulation, is accomplished by a phase locked loop 
detector. The amplitude modulation is recovered by filtering. Amplifi- 
cation as needed- to obtain signals in the 1 to 5 volt level shall be 
incorporated in the Demodular block. Each 30 Hz output signal is delivered 
to a separate package pin. This block will be' fabricated in hybrid 
technology in a single package. 

Localizer Filter: The localizer filter block shall contain 90 Hz 

and 150 Hz amplifier-filter combinations. Channel bandwidth' for each 
shall be 5 Hz at -3 dB and less than 60 Hz at -40 dB, Output voltage 
of the 90 Hz and 150 Hz signals shall be between 1 and 5 volts with 
a center-line equivalent simulated signal. Amplitude imbalance introduced 
by the filter network shall be less than 2%. 

Frequency Synthesizer : The frequency synthesizer shall be a 

digital input phase locked loop design. It shall provide local oscillator 
for the RF mixer so as to provide 200 channels between 108.0 and 118.0 
mHz in 100 kHz steps. Frequency stability and harmonic content shall 
be consistent with present standards. 

Level: Detect.: The level detect circuit shall provide a logical ' 

level output corresponding to the signal delivered from the RF subunit. 

Any signal greater* than 500 mV out of the AM demodulator output port 
shall produce a logical 1. Software to check this parameter at each 
computation cycle shall be included in the microprocessor algorithms. 

Pilot warnings shall be provided to advise of unusable signal strength. 

Test: The test modual and its accompanying analog MUX shall 
be capable of providing two 30 + I'Hz signals 180 degrees out of 

phase.' Actuation of the MUX and gating on the oscillator shall be 
under control of the microprocessor. A simple transistor or dif-amp 
circuit can be used to obtain these signals with a highly accurate 
phase relationship . 

Microprocessor: The microprocessor shall have a basic, cycle time 

equal or less than five microseconds. A CMOS unit is preferable with 
first priority going to the RCA COSMAC in a ceramic package. Five l/O 
ports, DMA, 16K bits of ROM and 4K bits of RAM should be sufficient 
to perform the required tasks* The software package shall contain sthe‘ ADF 
algorithms so that the OMNI computer can perform ADF functions in case 
of ADF microprocessor or memory failure. 
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Glide- slope: Glide slope reception is accomplished by a completely ' 

separate RF/Detector front end. This electronics subgroup is located 
at the GS antenna base. The glide slope signal is used only at short 
distances ’from the transmitter. Hence; the receiver complexity is 
rather low. Power, frequency synthesizer output, and the 90/150 Hz 
detected signal are all transmitted along a common coaxial cable. 

Output from the glide slope detector is multiplexed with the localizer 

output into a common 90/150 filter circuit. During the approach 

phase of aircraft operation the microprocessor actuates the MOX alternately 

computing Vgo/Vi5o ratios from the glide slope and localizer. Such 

ratios are then used to compute- angular deviation from the center 

line. This information is -available for 'transmission, via the BIH; 

to the central processor subsystem. 

The frequency synthesizer for the glide slope is designed to use 
the same 8 bit output code sent to the localizer, and generate the 
appropriate local oscillator signal for the receiver. This circuit 
uses a phase-locked- loop and frequency multiplier chain to generate 
the required’ input signal. 

The UHF RF amplifier is an FET broad band amplifier. Amplifier gain 
variation is less than + 3 dB over the entire glide slope band with 
no variable tuning. The RF amplifier and mixer-filter-detector circuit 
are to be fabricated in hybrid form in no more .than two separate packages. 
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Table 3,23 


ADF Subunit Parts Table 


Quantity 

Function 

Technology 

Complexity 

1 

Analog MUX, RF Amp, F/V 

Hybrid 

4 chip, 24 passive 

1 

Mixer, IF Amp 

Hybrid 

4 chip, 24 passive 

1 

AGC, MUX 

Hybrid 

3 chip, 12 passive 

1 

Frequency Synthesizer 

Hybrid 

4 chip, 24 passive 

1 

Analog Delay 

CCD 

LSI 

1 

A/D Converter 

Bipolar 

MSI 

1 

Product Detector, Audio 




Detatch fit Amp 

Hybrid 

5 chip, 20 passive 

1 

Microprocessor 

CMOS 

LSI 

5 

I/O , 

CMOS 

LSI 

1 

ROM 

CMOS 

LSI 

1 

RAM 

CMOS 

LSI 

1 

DMA 

CMOS 

LSI 

2 

BIM 

Hybrid 

9 chip, 32 passive 
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COMMtraiCATIONS SUBSYSTEM DESIGN 


Introduction 

The communication subsystem is structurally segmented into two 
parts. See figure 3.47. The main board which plugs into the system 
bus contains the -basic mode changing and controlling circuitry, the 
frequency synthesizer, and low power audio circuit. The transmitter 
RF power amplifier and receiver RF-IF section' are physically located 
at the antenna, becoming a part of the mounting base structure. 
Interconnection between the- two sections is via a dual coaxial cable. 

One design feature of this system is the incorporation of a linear 
amplifier for the transmitter output rather than the normal collector 
modulated class C type. Although the efficiency of such an amplifier 
is only 25% to 40% compared with 75% to 80% for a class C amplifier, 
there are several important advantages gained using the linear amplifier. 
First-, modulation can be carried out at a very low level, eliminating 
the need for a power audio amplifier system. Secondly, no bulky 
modulation transformer is needed. Since the power amplifier is powered 
down, except when in actual use, thermal problems are drastically reduced. 

A second design feature of the subsystem is the use of hybrid 
thick film microcircuit techniques for packaging. The entire system 
will be made up of approximately 9 hybrid circuit packages. These are: 

1) Transmitter Power Amp and T/R Switch 

2) Receiver Tuned RF Amplifier. 

3) IF Amplifier 

4) Audio Amplifier 

5) Frequency Synthesizer 

6) Controller 

7) BIM 

.8) Frequency to Voltage Converter and Power Control 

9) Modulator 

Each of these packages contain th i ck film resistors and capacitors 
plus SSI, MSI, and LSI chips as required. For example, the receiver 
tuned RF amplifier and IF amplifier modules will use RCA 3000 series 
amplifiers or their equivalents. The controller module will use a 
microprocessor chip, etc. Using this technology, circuit density is 
greatly increased and modularity is provided at the subsystem ' level . 


Controller 

The, controller must operate in a multi-state sequential mode, 
constantly -‘checking to see if the BIM has new data from the bus or if 
the’ 'mike' button has been activated. Although the controller could 
be fabricated from programmable counters and MSI logic elements it is 
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more probable that a two chip microprocessor set is a better choice. 
Examples presently available are the Fairchild F-8 system using a 
3850 CPU with a 3851 RAM and the Electronic Arrays EA 9002 CPU. 

The General Instruments PIC 1650 is a complete '1 chip processor including 
ROM and RAM. The RCA Cosmac is also a likely candidate machine. In 
addition LSI chips specifically designed for controller design are 
starting to appear. An example is the National COPS microcontroller. 

Such units could in the future provide a cost advantage. 

The controller is designed to recognize the mode commands and 
perform the required logical reconfiguration. 

Valid subsystem modes shall be defined as follows: 


Mode 

0 

1 

2 

3 

4 

5-6 

7 


Operation 

Receive with auto squelch 
Receive, no squelch 
Transmit 


Set receiving frequency 
Set transmission frequency 
Presently undefined 
Inactive 


Only one mode may be active at any instant of time. Mode changes will 
be instigated by the CP or another subsystem via a system bus. Data 
words corresponding to frequency control are also passed to the subsystem 
via the system bus. 


Frequency synthesizer . The frequency synthesizer shall be a 
phase locked loop design. Input shall be a 16 bit digital number 
from the controller. One bit will be used to indicate transmit or 
receive, the other 15 will define a basic frequency (720 channels). 

In the transmit mode, frequency synthesizer output to the modulator 
shall be the desired carrier frequency. Output power level shall be 
100 m watts. Harmonic content at any frequency shall be -80 dB with 
respect to the fundamental. Frequency stability shall be less than 
0.005%. Frequency range is to be from 118.0 MHz to 135.95 MHz, and 
channel spacing is 25 kHz. 

In the receive mode, the frequency synthesizer shall deliver the 
appropriate local-oscillator signal for the triple conversion IF 
amplifier section. 

Modulator . The modulator shall be capable of providing 95% AM 
modulation from the -100 m watt-peak audio amplifier output. The modulator 
shall provide automatic leveling for a minimum of 85% modulation and 
limiting so as not to exceed 95%. Distortion introduced by the modulator 
shall be less than 5% and harmonic content at any frequency less than 
-50 dB. Power output from the modulator shall be 100 milliwatts. 
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Transmitter BF amplifier . The output amplifier shall be 
operated in class AB linear, and provide a PEP ^ 24 watts to the antenna. 
Intermodulation distortion shall be less than -30 dB • Rated output 
shall be achieved with an input power of 100 m watts CW modulated at 
no less than 85%. The transmitter shall contain any required matching 
network to load the antenna as required to achieve the specified PEP. 
Spurious response shall be as specified in FCC part 87 requirements. 

The transmitter shall be capacitively coupled to the coax- center 
conductor to assure there is no interaction with the DC tuning voltage 
carried on the wire. 

T/R switch . The T/R switch shall be arranged so as to normally 
provide connection of the antenna to the receiver amplifier. It shall 
provide connection to the transmitter output when dc power is supplied 
to the transmitter. Insertion loss of the switch shall be less than 1 dB 
over the entire frequency range and Isolation shall be in excess of —30 dB. 

Receiver TRF amplifier . The RF amplifier shall provide a voltage 
gain in ex'cess of 20 dB at the 50 ohm coax and exhibit a noise figure 
of less than 6 dB. Internal gain modification must be such as to 
eliminate. distortion as the input signal ranges from 1 to 100 uV. 

The amplifier shall be tuned via varactor control, the appropriate 
control voltage obtained form the F/V converter. 

Frequency/Voltage converter . The F/V circuit is designed to 
convert the synthesizer output mixer signal to a dc voltage of appropriate 
amplitude to tune the RF amplifier at the appropriate center frequency. 

Audio amplifier . The audio amplifier shall be capable of producing 
100 mwatts SMW power into a 75 ohm load at 1 kHz. Frequency response 
shall be + 3 dB for 400 Hz £ f _< 4 kHz. The audio amplifier circuit will 
have internal control circuitry to provide controller input switching of 
input and output. With a logical 1 control signal the input is connected 
to, the IF amplifier and output to the speaker subsystem (listen mode). 

For a logical 0 control level the input is connected to the mike and the 
output to the modulator. The circuit must be designed so that the most 
probable failure mechanisms drive the subsystem to the "listen" mode. 

In "listen" mode a standard headphone output signal is delivered to 
the "special controls" panel. 

- BIM . The BIM is required only to exhibit characteristics of AH, 

L, SH, and T. Standard LSI chips soon to be available from INTEL and 
Motorola will adequately perform this function. 


124 



Table 3.24. Communications subsystem parts table. 



1 Class AB RF Xmitter Amp Hybrid 6 chip 40 passive 
1 Revr, RF Amp, T R Hybrid 4 chip 28 passive 
1 IF Amp, F/V converter Hybrid 6 chip 42 passive 
1 - Coax connector 


Central System Printed Circuit Module 


1 

1 

1 

1 

2 

2 

1 


Frequency synthesizer Hybrid 6 chip 

Modulator Hybrid 5 chip 

Audio amp & power control Hybrid 4 chip 
Microprocessor MOS 

I/O Extensions MOS 

BIM , - Hybrid- 9 chip 

Coax connector 


24 passive 
30 passive 
24 passive 
LSI 
LSI 

32 passive 
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FLIGHT FOLLOWING SUBSYSTEM 


The flight following subsystem within the present design context 
is essentially a standard ATCRBS transponder with altitude encoding. 

The configuration and implementation however are compatible with the latest 
technology and the team computer system concept. A block diagram is sho^m 
in figure 3.48. ' 

The BF section, physically located at the antenna base is conventional 
with respect to present hardware. The oscillator is to be designed 
around a solid state device such as a TRAPETT diode Microwave Integrated 
Circuit. Hybrid technology is ideally suited for fabrication of this 
section of the subsystem. Pulses to the modulator and from the IF 
detector, are ac coupled onto the single coax connecting these two 
units of the subsystem. 

The signal processing and code generation is carried out on the 
main system printed circuit board. 

When an interrogate pulse train is demodulated by the front end 
RF subunit, analysis of this signal is performed using conventional 
techniques. All electronics for this function will be contained in 
a. single hybrid package. The output from .this package is three lines, 
denoting mode A, B, and C. One of the three will go to logical 1 to 
identify the requesting mode. 

The microprocessor unit accepts as input the mode request, and 
formulates the appropriate reply sequence. This sequence is transmitted 
serially to the modulator/oscillator for transmission. In addition 
the microprocessor carries out the functions of communicating 
with the system through the BIMs. Such communications involve obtaining 
altimeter data, squawk codes, and Ident commands. When "Beacon 
Collision Avoidance" (BCAS) becomes available, this subsystem is 
capable of carrying out the required functions. Information will be 
decoded and delivered to the display for pilot action. 

As up and down link communications (DABS) techniques become 
developed, it is likely that the role of this subsystem may expand. 

At such a time, this subsystem may be replaced by a more complex one, 
completely compatible with the BCAS environment. However, this simply 
requires replacing, the present board with a new one having Increased 
functional capability. Such a change would in no way alter the overall 
system structure. 

'.t'tib' ROM must be partitioned in such a way that upon request, 
the operating program to be resident in the Central Processing Subsystem 
can be transmitted over a BIM. 
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Table 3.25. Flight Following Parts Table 


Quantity 

Function 

Technology 

Complexity 


1 

1 

1 

1 

Transmitter (output & 
pulse mod) 

L.O. , Mixer 
Amp, Detector 

Quartz Crystal 

Hybrid 7 chip - 35 discrete 
Hybrid 3 chip - 18 discrete 
Hybrid 5 chip - 30 discrete 

1 

signal conditioning, 
mode decode 

Hybrid 

6 chip - 36 

discrete 

4 

I/O 

MOS 

LSI 


1 

Microprocessor 

MOS 

LSI 


1 

ROM 

MOS 

LSI 


2 

BIM 

Hybrid 

6 chip - 20 

discrete 

2 


Coax connectors 


2 


PC Boards 
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STORM AVOIDANCE SUBSYSTEM 


Storm avoidance in terms of hazard to flight is probably more • 
realistically defined as turbulence avoidance. -Research, (such as 
that by W. L. Taylor £n Remote Sensing of the Troposphere . NOAA report, 
ed. V. E. Derr, August 15, 1972 titled ’’Atmosphere and Severe Storms”, 
pp 17-1 to 17-17) indicates that wind shear associated with high turbulance 
causes localized electrostatic charge separation and hence lightning 
discharge. The ’’Stormscope” concept of detecting and displaying a 
replica of discharge density has recently been commercialized by 
Ryan Stormscope corporation. Cost, weight, and reliability are all 
factors which favor the stormscope concept over conventional radar. 

The RF section operates in the low megahertz range for stormscope 
contrasted to the 10 gigahertz for radar. A conventional ADF antenna 
is sufficient for stormscope, while an elaborate, heavy, expensive 
directional antenna is typical of radar installations. The stormscope 
requires only a receiver, while a radar requires transmitter and receiver. 
In addition to these hardware considerations there is some evidence that 
lightning discharge density is a more reliable measure of turbulence 
than water density. We anticipate that within the next decade such 
information will be more formally verified and a transition made to 
stormscope as a primary storm avoidance technology. The subsystem for 
this design is therefore chosen to be an electrical discharge ’’stormscope" 
detector. However, if later evidence suggests conventioanal radar 
techniques are more desirable, a direct substitution can be made. 


Hardware 

A block diagram of the subunit is shown in figure 3A9.The remote 
section, mounted at the antenna base, contains: 

a) Fixed Tuned RF amplifier 

b) Mixer and IF amplifier 

c) Appropriately structured AVC 

d) Detector 

Design of this section is essentially Identical to that of the present 
commercial "Stormscope”. Hybrid technology will be used to reduce 
size and increase reliability. 

Processing of the detector output in terms of amplitude and width 
distribution and rate will be carried out with software algorithms 
which essentially duplicate the hardware techniques used by Ryan. 
Resulting detected strikes are stored in memory along with computed 
pseudo-range and angle. The strike position however, even though 
determined with respect to the aircraft axis, will be recorded in 
latitude-longitude coordinates. 
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Figure 3.49 Stormscope weather 

avoidance subsystem. 
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RF AMP 
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The algorithm designed to prepare the data for disjilay will then 
locate the recorded strikes, on the horizontal map display in true 
geographic coordinates. The resultant pattern, overlaying the map, 
will present an accurate representation with no lag or perslstance 
to previous aircraft heading. 

The conqjuter for this task can be any device of the Motorola 
6800 complexity and speed capability. The BIMs are standard’ LSI 
chips as previously described. 

The subsystem contains two modes of operation. They are 

Mode 1 Monitor only 

Mode 2 Display 

In mode 1 the subsystem monitors the memory storage region where strike 
detections are stored. If equivalent spatial density or intensity indicate 
potential storm activity or turbulence, the CP system is notified. 

In mode 2 the subsystem constantly overlays- the electrical activity 
output on the map display. 

Transition* from mode 1. to mode* 2, activated by the CP, will 
normally be carried out automatically. The pilot can force the system, 
into either mode by using the System Modify Function mode. 


131 



Table 3.26. Stormscope Subsystem Parts Table - 


Quantity Function Technology Complexity 


1 

1 

1 

RF Amp, Mixer 
IF Amp, Detector 
Coax connector 

Hybrid 

Hybrid 

4 chip, 28 passive 
6 chip, 42 passive 

1 

1 

Coax Connector 
A/D 

MOS 

LSI 

1 

Microprocessor 

MOS 

LSI - 

1 

BAM 

MOS 

LSI 

1 

BOH 

MOS 

LSI 

3 

I/O 

MOS 

■ Lsr 

2 

BIM 

. Hybrid 

9 chip, 32 passive 
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VOICE GENERATION SUBSYSTEM 


The Voice Generation Subsystem will be an all- solid state electronic 
device capable of producing human speech through the use of phoneme 
concatenation and vocal tract simulation. A message will be formed 
by linking phonemes together in a dynamic fashion so that each phoneme 
blends naturally with the one proceeding as well as the one following 
it. Each phoneme will have four levels of inflection assigned to it, 
by the message assembly section, in order to provide smooth transitions 
and natural sounding speech. This concatenlzed phoneme string of data 
will then be sent to an articulatory model for conversion to amplitude 
.varying electrical signals. The varying amplitude electrical signals 
will then be sent to the audio section for proper processing and 
dlsposure. Figure 3.50 shows the basic system layout for' the voice 
generation subsystem. 

The voice generation subsystem will consist of s 

a) A microprocessor based controller to act as supervisor of 
message assembly. 

b) ROM storage for phoneme data storage. 

c) ROM storage for message and’ sub-message addressing. 

d) RAM storage for the assembled message data. 

e) Hardware Implementations of an articulatory model of the 
human vocal tract. 

The voice generation subsystem will reside in the Integrated Instrument 
Package and will, be considered part of the basic essential instrumentation 
system. The voice subsystem will be powered from the Instrument Package 
Power Bus and will be expected to operate in the environment specified 
for the overall central processor housed instrument case. The microprocessor 
based controller will function as a listener only, and communicate directly 
with the CP. 


Message Assembly 

The message assembly section will be built around a microprocessor 
acting as a control supervisor during message generation. Each phoneme 
when finally assembled will consist of an eight bit word. Each word 
will contain both phoneme information and Inflection data. The phoneme 
data word will follow the format shorn in figure 3.51. ■ 
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Inflection Data Phoneme Data 












8 bits Phoneme Data Word 


Figure 3.51 Phoneme data format. 


The system will provide the capability of composing messages 
which might consist of at least 64 different phonemes. In order to 
initiate a voice synthesized message to the pilot , it will be the 
responsibility of the CP to send the voice subsystem controller a 
data word- containing the starting address and the length of message. ■“ 
The controller will then assemble the message. A dynamic storage 
(RAM) section will be provided to hold the message until the assembly 
process is complete. The subsystem controller will provide the timing 
and interaction signals necessary to communicate with the articulator 
simulation hardware. Figure 3 .52 shows how the read only memories might 
be arranged. 


Articulatory Model 

The Articulatory Model will provide an electronic simulation of 
the human vocal system, and will be able to produce most of the sounds 
natural to- the human voice. This model will be driven by phoneme 
data and implemented by analog circuitryi This analog section will • 
consist of a series of variable active filters which synthesize the 
variable resonances or formant information in the vocal and nasal 
tracts'. Forcing function generators will provide the filter excitation 
which represent vocal cords and fricative sound sources. Dynamics 
of the vocal tract parameters during transition from one phonemic 
sound to another will be generated by a low frequency function generation. 
This low frequency generation is controlled By ,'the decoded Inflection 
data provided in the two most significant bits of the 8 bit phoneme 
data word. Figure 3.53 shows the articulatory model. 

The vocal tract muscle commands will be simulated by a digital 
to analog converter which will serve as the control signal for the 
low frequency function generator which simulates phonetic articulations 
in the human vocal system. The D/A converter will be driven by the 
least significant ,6 bits of the phoneme data word, from the subsystem 
controller. It Is expected that the present course of development 
will produce an all digital LSI circuit to replace the present analog 
vocal ■ tract simulation. 
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Vocal Cords & 
Fricative Sounds 


Figure 3.53 Articulatory model 




Vocabulary 

The voice synthesis system will be capable of composing messages 
from a ROM stored vocabulary of at least 150 words# The following 
vocabulary list is typical but not all inclusive# The vocabulary list 
will be stored utilizing a method which will permit adaptation of the 
vocabulary to a particular installation# For example a field programmable 
ROM might be used# This would allow the vocabulary size and content 
to be altered as the system is expanded# Also particular ROM sets 
could be aimed at navigation while another set could be designed for 
flight check list or diagnostics. It is not implied that extra sets 
of ROMs be interchanged within a system but that different emphasis 
might be associated with various applications, i#e. VFR only system 
on small planes vs. fully equipped twins. 

The voice generation equipment will be allowed to sound machine 
like. This has the following advantage: In a busy environment where 

the pilot is communicating with controllers, it would be advantageous 
to have a special characteristic in the voice that warns of imminent 
danger# In other words the pilot can easily distinguish between the 
controller and the machine. The Audio Control Panel will provide gain 
and pitch control of the Vioce Synthesizer Subsystem# 

Typical synthesizer vocabulary set# 


zero 

com 

one 

compass 

two 

compression 

three 

course 

four 

current 

five 

cylinder 

six 

danger 

seven 

descend' 

eight 

decision height 

nine 

degrees 

above 

dive 

actuators 

electric 

air 

, engine 

alternator 

exhaust 

altitude 

flap 

approach 

flight 

autopilot 

flow 

barometric 

frequency 

below 

fuel 

bound 

gallons. 

carburetor 

gas 

check 

glide slope 

climb 

head 

clock 

heading 



138 



heat 

•tank 

holding 

temperature 

ice 

tip 

inner 

thousand 

in 

throttle 

left 

tolerance 

lights 

turn 

limit 

vacuum 

localizer 

vector 

main 

visible 

maintain 

voltage 

manifold 

VOR 

marker 

way 

mechanical 

middle 

wing 


missed 

mixture 

nav* 

number 

obtain 

off 

oil 

on 

outer 

outside 

oxygen 

pitch 

pattern 

plan 

point 

position 

pressure 

proceed 

procedure 

propeller 

pump 

quantity 

rate 

radial 

receiver 

remaining 

right 

route 

RPM 

runway 

speed ^ 

stall 

switch 
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Table 3.27. Voice Generation. Subsystem Component Parts Table 


Quantity 

Function 

Technology 

1 

Bus Interface Module 

Hybrid 

1 . 

Microprocessor (CPU) 

CMOS 

1 

4K Read Only Memory (ROM) 

CMOS 

1 

IK Randon Access Memory (RAM) 

CMOS 


Articulatory Hardware 



a) D-A Converters 

Hybrid 

1 

b) Function Generators 

c) Active Filters 

■ Module 

4 

Quad Mand 

CMOS 

1 

Crystal 


1 

8 bit Output Port 
Miscellaneous Hardware 

CMOS 
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POWER CONTROL SUBSYSTEM- 


Experiments performed by SIU/CAC have shovm that significant 
voltage transients are common on the normal aircraft bus. This is 
especially true when any equipment such as strobes or landing lights 
are initially turned on. It is important that the digital system be 
Isolated from these disturbances. The transients however are of such 
amplitude that simple regulation is ineffective. Voltage drops to 
as low as 3 volts, before recovery back to nominal are common. 

The main system power bus shall therefore be supplied with voltage 
as shown in figure 3.54. Provision is made for a variety of possible 
failure modes and simple pilot override. 

Basically, a second bus is added to the existing aircraft power 
system. This bus (Avionics System Bus) is attached to its own 14 volt 
battery. The two buses are interconnected by a protect/regulator circuit. 
Under normal conditions, switch Sj and S '2 are closed. Switch positions 
for the following failures are as shown: 

1) Aircraft bus fails to ground 

a) Protect /regulator circuit opens, isolating Avionics System 
Bus. 

b) If protect circuit fails. Si manually isolates bus. 

2) Avionics battery fails - Opening S 2 allows Avionics System Bus 
to be regulated as best as possible from Main Aircraft Bus. 

3) Protect/regulator circuit fails open - System continues normal 
operation for 20 Amp hr life of B 2 . This is approximately 

45 minutes at full system load. 

4) Protect circuit fails shorted - Isolate by opening Si. 


Protect/Regulator Circuit 

The protect part of this circuit provides switching control capable 
of Isolating the two buses during low voltage transients on the main 
aircraft bus. In addition it is designed to open the inter -bus path 
if the current exceeds a predetermined upper threshold, e.g. 60 amperes. 

The circuit must respond with the above actions in less than 2 microseconds. 
The unit also acts as a switching regulator to drop the 28 volt aircraft 
system bus to the avionics bus 14 volt level. Most MOS and CMOS circuits 
can operate from the 14 volt avionics bus with little or no regulation. 

Thus by using a common 14 volt supply, regulators at the Individual 
board level are also eliminated. The CPS’s are provided algorithms 
to monitor voltage and current at both buses. Thus the existence of any 
fault will be decoded and appropriate corrective action specified to the 
pilot. This message will be displayed on the panel with an accompanying 
aural warning. 
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SYSTEM PACKAGING 


The system will be packaged in a variable width box 15.87 cm 
high by 30.48 cm deep in size. See figure 3.55 3h the rear of the 
box is a motherboard on which all information bus lines and power 
lines reside. The subsystems will plug into the motherboard 
from the .front of the box. Cooling air for -all components will 
be ducted' and forced through the box as required. External displays, 
antennas with’ associated electronics, and additional system boxes 
may be added as required through the use of main bus- extenders' 
and peripheral interface cables plugged into the main buslines. 

A front view of the system box with a possible set of modules for a 
very well equipped aircraft is shown in figure 3.56. 

Table 3.28 is a compilltation of weight and power for three 
Advanced Avionics System configurations. The three are: 

1) Full IFR system for Cessna 402 

2) Moderate preformance installation in a single 

3) Partial retrofit in a single 

The component selection of these systems has been described in some detail 
in section IX. In addition to the AAS configurations, data are pre- 
sented for the baseline system. Power is calculated as an average 
rather than peak value. The range shown represents a reasonable 
uncertainty in the estimates. 
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Figure 3.55. Rear view of system package. 
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Table 3.28. Weight and Power data for system configurations of 
different complexity 


System ' Weight (kg) Power (watts) 


Baseline system 

77.1 

700 

Cessna 402 AAS 

64.7 

450-500 

Single engine AAS 

18.3 

210-260 

Partial retrofit AAS 

10.6 

85-100 
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AUDIO UNIT AND SPECIAL FUNCTION KEYBOAED 


General 

The 'system shall have a single audio amplifier unit which services 
those subsystems having either mike inputs or audio outputs. This 
Includes : ' , 

a) Communication subsystem 

b) ' Nav subsystems 

c) Voice response subsystem 

d) Voice recognition subsystem (optional) 

In addition there shall be an associated ancillary unit defined as 
the Manual Special Keypad. This unit shall provide direct manual control 
of such parameters as audio voltime level, display panel brightness, 
night illumination, etc. It might also contain an emergency alternate 
power switch, and other critical function controls- which should be • 
available for manual intervention should certain critical situations 
arise. 


Audio Unit 

This unit shall be provided with direct cabling to each unit it 
serves. The' unit does not communicate with any system bus. Design 
methods ,shall be used which minimize the number of interconnecting 
wires. The interconnection must he such that in addition to carrying 
audio signals, a logic dc level on the line indicates that the subsystem 
has audio priority. The input with priority, will have unique access 
to the audio amplifier when a signal is present on that line. The 
audio unit is designed so that when the 'transmit button is activated, 
the appropriate audio line contains the mike signal. 

Operating characteristics . The audio subunit shall have outputs 
to both headphones and a speaker. The audio power amplifier driving 
the speaker shall have an output capability of 5 watts. 

Redundant amplifier units may be used to decrease failure 
probability if desired. 


Manual Special Keypad. 

The keypad shall be independent of the system box. It may be 
located anywhere in the cockpit within a distance of 1.5 meters- of the 
box. A proposed 402 location is on the quadrant pedestal, below the 
throttle-mixture levers. Electrical connection to the system shall 
be by a dedicated cable assembly independent of the system bus. 
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Level control will be performed using pulse generating switches* 
Increase-decrease type of control shall have both a control key pair 
and a relative position display* An example of the volume control is 
shown below* 



o 

o 

o 

o 

o 


MAX. 


.ME3D. 


MIN. 


The switch pair is composed of two, two-position switches. 

Pushing a switch to first "click" results in the generation of a pulse 
sequence at a slow Incrementing rate. Pushing it down hard, i.e. 
to the stop, results in a fast incrementing rate. Connected units 
must be designed to change levels in response to these pulse trains. 

An array of 5 LEDs provides identification of minimum, medium-low, 
medium, medium-high, and maximum levels. Figure 3.57 shows a proposed 
layout for this panel. Display swap is initiated' by simply pushing the 
key in the upper right hand comer. Alternate pushes create 
sequential swaps. The slew controls are return-to-neutral toggle 
switches below the swap key. The toggle switches along the bottom 
control the disposition of audio output from each subsystem. A switch 
in the up position transfers the audio signal to speaker. A down 
position causes delivery to the headphones. Mid position is equivalent 
to "off" for that subsystem. 
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Figure 3. 75.. Manual Special Keypad Layout. 
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MASS MEMORY 


The mass memory subsystem is a read only archival storage unit 
from which the system can obtain: 

a) Information for map display 

b) CP operating systems (normally lOS only) 

In this system design a four track ,tape cartridge unit with a 3M Model 
DC300A cartridge provides the storage. A block diagram of the subsystem 
is shown in figure 3.58. 

The cartridge mechanism, drive electronics, and related power 
supplies are assembled in a single unit and mounted behind the 
instrument panel. Because of the high current pulses (4 amps) 
required by the motor, a heavy direct connection is- required to, the 
avionics system 14 volt bus. In addition a cable bundle, consisting 
of 11 twisted pairs in a common- jacket goes between the remote panel 
mount and -the subsystem printed circuit card in the system box. 

Control signals to, operate the motor and the returned sense head 
signals are communicated to the -subsystem controller through standard 
I/O channels. 

The controller is a very simple single chip microprocessor. 

It shall have sufficient on-chip ROM and scratch pad RAM to carry out 
its functions. A cycle time of 5 microseconds is' adequate. The 
controller shall act primarily as a communications channel between 
the tape head electronics and the BIMs. 

Typical examples of tape mechanism hardware adaptable for this 
job is the Mohawk Data Sciences M9del.2021, and the Kennedy Co. Model 
311.. Modifications to eliminate the write and erase functions will 
be made. Basically this simply requires eliminating some optional 
hardware. However, in addition, a power supply board would have to 
be added to provide -12 volts- (for the Mohawk 2021) or -24 volts for 
the Kennedy. 331. An alternative to the negative voltage power supply, 
might be to add switching electronics to the motor windings to provide 
for reversing. Op amps and similar analog electronics normally using 
positive and negative- voltages could be supplied from a relatively 
simple DC to DC low. current converter. 

Basic specifications for these mechanisms desirable for the 
mass memory subsystem are: 
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Read Tape Speed » 0.635 m/sec (25 ips) 

Search and Rewind Speed = 2.28 m/sec (90 ips) 

Recording Density = 62000 bits/m (1600 bpi) 

Number of Tracks =4 

Physical Dimensions = . 15m x . 25m x ♦ 20m 
Weight = 2.3 Kg 

In addition to the mechanism weight, the cartridge itself adds 
.25 Kg (9 oz) . The tape is 100 meters long by 6.4 x 10"^ meter wide. 
It has a maximum capacity of 23 x 10® bits. 

, An estimate of bit capacity has been made to evaluate the 
requirements to encode the following for map display: 

Every city over 2,000 people 
Every Nav Aid 

Every public access airport 
Every restricted zone 

Every tower or navigational hazard^ shown on sectional maps 
Max im u m elevation in every 30 nautical mile square sector 

The result indicates a required storage capacity of approximately 
12 X 10® bits. This does not include formatting gaps. It therefore 
appears that the 23 x 10® bit capacity .of a single 3M cartridge will 
be sufficient to hold the data required for the entire United States. 
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SECTION M 


SYSTEM -MODELING 


REASONS FOR SIMULATING 

Simulation provides a means of trying out concepts 
without having to spend the time, money, and effort involved 
in testing, mounting, and connecting components. Such 
routine, but expensive and time-consuming chores as 
obtaining the hardware components, and replacing those that 
fail or are destroyed in tests are avoided. Simulation can 
have just the level of detail needed to enable the system 
designer to draw conclusions about system characteristics. 
Simulated system configurations can be easily changed. 
Naturally, once a viable design has been selected, a 
prototype is desirable to insure that the system will 
perform as expected. 


SIMULATION OBJECTIVES 

The sensor actuator subsystem simulation is fairly 
general and was performed to appreciate how the software 
would work together in the subsystem itself, and to gain 
experience with the types of service' mix which could be 
provided using a multilevel software algorithm. 

The CPS simulation is quite detailed and takes into 
account the timing, especially the setup times, the hold 
times for the various inputs, and the delay times between 
the inputs .and the outputs. Thus the total digital system 
itself, and not merely the functional characteristic of the 
system, is simulated. -Such a simulation is felt to be a 
realistic test of the validity of the microprograms, used in 
the overall avionics system design. Timing and system 
overload problems could ultimately be revealed given 
sufficient simulation emphasis and support. 

Microprocessor element simulation includes the 
transition times involved in element -input and output 
changes. This provides a means of investigating the 
ho-man's region between the logical high and low levels. 

Such an Investigation may be crucial -since most production 
level, equipment timing problem's and unpredictable 
performances of the system can be traced to this region. 
Given the shortest. and the longest transition periods of the 
various signals (as specified by the manufacturer), one Cein 
test a system assuming the extreme conditions. If the 
system functions properly under these conditions, it would. 
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moat likely, perform well under normal conditions where the 
different signals change at different rates within the 
extrema. Such a simulation will thus provide a powerful 
tool for developing a worst-ease design. ' 


THE LANGUAGE CHOSEN 

The simulation language chosen, GASP-PL/I, is a 
combined discrete/continuous simulation language, based on 
PL/I. GASP-PL/I is not a simulation language in the strict 
sense of the word. However, for .want -of a better term, it 
is referred to as such in this article. 

Major Features of GASP-PL/I 

GASP-PL/I is a relatively new simulation language 
(September ‘\975r though its predecessor, GASP-IV, a 
FORTRAN version, has been in use for seme time (September 
1973)^. GASP-PL/I, like SIMSCRIPT uses an 

event-scheduling approach to control system dynamics. This 
is unlike GPS and SIMULA which are based on an 
activity-scanning approach. 

The GASP-PL/I system model is very similar to the one 
adopted in SIMSCRIPT. A system is composed of sets of 
entities, and the entities are defined by their attributes. 
System dynamics are simulated by modeling the events and by 
executing events by time order, all the while advancing 
simulated time. The major difference between discrete 
SIMSCRIPT and discrete/oontlnuous GASP-PL/I is that the 
latter permits attribute values to change between 
event-times. These continuous, or dynamic attributes are 
termed state variables. The term ’attribute* is used to 
denote a discrete attribute, which changes only at event 
times. The inclusion of state variables permits the 
triggering of an event when the system reaches a particular 
state value. Thus the definition of an event here is more 
comprehensive than in discrete- event languages. It includes 
both time-events which are scheduled at a certain point in 
time in the future, and state events, which occur when the 
state variables meet some prescribed values or 
relationships. GASP-PL/I permits state variables to be 
defined in terms of their derivatives. If a state variable 
is defined by an equation for its derivative, then GASP-PL/I 
uses a Runge-Kutta integration procedure to compute the 
value of the state variable. The previous values of the 
state variables and the derivaties, (i.e., values at the 
beginning of the current step) are also available for use in 
equations defining state variables. 
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GASP-PL/I consists of a number of procedures written in 
PL/I. A simulation program in this language consists of a 
user written part and a GA'SP-PL/I part. The GASP 7 PL/I part 
provides the major simulation functions such as control of 
the system dynamics, updating the state variables, 
manipulation of the data base, monitoring, error reporting, 
etc. 


The user-written part consists mainly of event 
procedures which define the changes and ’ computations that 
occur at an event time, procedures to define the equations 
for computing state variables, and the conditions for state 
events . 

GASP-PL/I provides a sophisticated time advance 
mechanism to support the combined simulation facility, in a 
purely discrete, simulation, time is advanced from one 
time-event to another, as in other discrete event-simulation 
languages. In a purely continuous simulation, time is 
advanced to the next computational time. In the case of a 
combined discrete/continuous simulation, the user specifies 
the maximum ^d the minimum limits on the step size used- to 
advance time. Time is updated tentatively by a step size 
equal to the maximum step size. If it is found that a state 
event has been passed within the step, the step size is 
halved. This procedure is repeated until the conditions for 
the state event, within the prescribed tolerances, are met 
at the end of one step. If a time-event 1s passed within a 
step, the step size is automatically reduced so that the 
time event occurs at the end- of the step. If some of the 
state variables are defined by equations for their 
derivatives, then after the step size has been determined as 
above, it is divided into fourths, and the state variables 
are evaluated by using the values of the derivatives at 
these points, utilizing a Runge-Kutta integration algorithm. 
The step size is accepted if error criteria specified by the 
user are met. Otherwise, the step .size is halved, and this 
process is repeated until the ‘minimum step size specified by 
the user is reached'. 
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SIMULATION PLAN 


A key feature of simulation is that it can provide a sound basis for 
carrying out trade-off analysis. Thus one can evaluate system performance 
degradation dynamically in simulated time as components are failed. Studies 
of the system response as a function of the number of CPS unit can be 
carried out". Algorithms can be developed and evaluated to perform fault 
detection without a heavy hardware investment. Storage requirements and 
processor requirements of subsystem units can be accurately evaluated. 

These, and many other, capabilities indicate the desirability of system 
modeling. 

In the research of this contract, the modeling effort was initiated 
after key system features were qualitatively defined. A simulation plan 
developed whereby the entirely Interacting system could ultimately be 
constructed. The plan is based on a stepwise development of individual 
system components. A block diagram of the simulation plan is. shown in 
Figure 4.1 . Each block is to be simulated independently as an individual 
segment of code. Each subsystem must be able to communicate over the bus. 

The BIM units are Included in the bus simulation subset. Thus, any subsystem 
simulation need only be able to communicate to the BIM via a standard 
16 bit code. Partitioning the system in this way eliminated the necessity 
of including elaborate bus protocal software in each subsystem. In addition, 
it is easy to operate the simulation independently. Bus interaction in 
this case may be neglected or handled by very elementary simulation. 

Because of time limitations , actual simulation of code has only been 
written for the sensor-actuator and CPS subsystems. Those being key systems 
components were started first. In addition work was carried out on the 
Bus System Simulation but the resulting code was not developed to operational 
status. 


SENSOR ACTUATOR SUBSYSTEM SIMULATION 

One of the key questions to be studied by the S/A simulation was how 
much computer capacity would be required. More specifically, given a 
specific processing algorithm and processor speed, what sampling rate 
restrictions exist. Sampling becomes a potential problem when considering 
that over 100 signals amy have to be monitored and in addition the required 
sampling rates of different signals may vary over at least a hundred-to-one 
range . 

In the simulations carried out to date, only the sensor portion of the 
subsystem has been studied. The simulation studies an algorithm which is 
diagramed in Figure 4.2 . Note that both serial and parallel input data 
are assumed. This is necessary because the serial data requires at least 
eight cycles to transfer in while parallel data sources will obviously affect 
total processing speed. 
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Figure 4.2. Engine monitor model. 



The major algorithm flow consists of four steps. They are: 

1) Compute the address at which to access a new data system. 

2) Transfer the data to memory. 

3) Test to see if all data of a particular type has been collected. 

4) Test to see of the Bus is requesting any data. 


Compute Data Source Address 

i Each': transducer is assumed to have an address. This is consistant 
with ;thei f hardware system. Here the address is assured to be a two digit 
number (M,EN). EM can take on valures of 1, 2, or 3 and corresponds to 
the "priority" of the resulting data byte. A priority of 1 means that 
the data should be sampled at the highest rate. Priority 3 is sampled 
the slowest. The value of EN is simply a reference-number for a particular 
data source within its priority level. In general 1<^EN^EN (MAX). 

Each priority level is divided into two groups of addresses; .those 
corresponding to serial output transducers and those corresponding to parallel 
output transducers. Serial output transducers have sequential addresses between 
EM, 1 and EM ENw^ The assignment for these limits are stored in an 

array called MAX^ It Is diagrammed as Figure 4.3B. Row one of the array 
corresponds to the limits for priority level 1 transducers . The first 
entry MAX (1,1) contains the total number of transducer addresses assigned to 
priority level 1. . The second entry MAX (1,2) contains the number of serial 
addresses. Thus MAX (1,2) is identical to EN (MAX. SER.) written above. 

Figure 4.3A^ shows a diagram of the address scheme. 

The ^addressing algorithm studied operated as follows. Sequentially 
address ^All priority 1 addresses . Next address the first priority 2 trans- 
ducer.^/ Now return and re-run through all priority 1 transducers. Then 
select the second priority 2 transducer. Return to the priority one group. 
Con^nue in this manner until all priority two transducers have been addressed 
once.. Next pick up the first priority level 3. Sequence through the one and two 
priorities again as before and subsequently address the second priority 3 
transducer. The process continues in this manner until all priority 3 
addresses have been accessed and then state the whole process over again. 

In the flow diagram of Figure 4.2 , the addressing algorithm is carried 
out in the block "Compute New Address." The advantage of this algorithm 
is that it is essentially self- timing. No hardware time is required to define 
simple rates. Obviously, sample Intervals are a function of the number of 
transducers in each priority. . In addition, the number of serial output 
transducers is significant. The simulation can evaluate subsystem performance 
as these parameters are varied. 
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Transfer Data to Memory 

In this section a test is made to see if the decoded transducer 
address Is that of a serial or parallel output transducer. 

If a parallel transducer is to be serviced, the data is straightway 
transferred from the transducer output to memory. In the simulation, 
memory is simulated by an array called DATA (see figure 4.3F), Each 
element of the array is identified by the address elements of the 
corresponding transducer. 

If the address is associated with a serial output transducer 
a string of sequential events is initiated. First a simulated counter 
is started. This corresponds to reading data from a VCO in the real 
system. In the simulation, the program records the time at which 
the "Start Counter" event takes place and sets a counter flag to 1. 

These actions are recorded in a register called CTSFLG. (See' figure 
4.3c). Assuming the counter is to collect VCO output data for 10 ms 
the algorithm transfers to a "Process" algorithm. Processing tests 
in the real system correspond to converting raw data to binary code 
for transmission to the CP, comparing data against limits, linearizing 
on curve fitting as required, etc. The processing algorithms are assumed 
^ to be broken into 10 ms segments. This is accomplished by programming 
, in exactly the required number of instructions per segment. Following 
a 10 ms process interval, the simulation transfers' to a "Stop Counter" 
event. In this event simulator time is noted and compared with the 
"Start Counter" time to check that exactly 10 ms have elapsed. This 
is followed by a "Transfer to Memory" event for the counter output. 


Test 


In the "Test" sequence, two key tests are made. The first is to 
see if all addresses in a given priority level have been accessed. 

If not, an Immediate return is Initiated to continue the data collection. 
However if all transducers of a given priority have been accessed 
then a test is made to see if the processing tasks for that priority 
level are completed. The idea here is that all linearizing, comparing, 
and manipulating of data should be performed before the process of 
collecting new data samples continues. This is accomplished by the 
"Process" feedback block in the "Test" segment of figure 4.2. 


Process Algorithm 

The process algorithm test is flow diagrammed as figure 4.4. 
All computations for priority 1 signals are broken into segments of 
10 ms of code. A pointer is established to define which segments 
should be done next. In addition a flag is altered to define 
if all processing is complete. 
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The flow diagram is essentially self explanatory. Based on the 
EM value of the address branching occurs to one of the three groups 
of process segments. A test is made on the Process Flag state. If 
the flag P is "0" it means that the processing has previously been 
completed and work should start from the' top. In this case initialization 
is carried out and processing of the first segment begins. Alter 
10 ms of code execution, the pointer I is incremented and exit is made. 
Upon re-entry at another time, the pointer P will be 1 and processing 
will continue at an. address defined by the pointer I. The pointer I 
as well as those of J and K for the other priority sequences are 
stored in a register called CTR. The process flags are stored in 
a register called P (see figure. 4. 3D and E). 

Note that by breaking all computations into 10 ms segments great 
flexibility is afforded. Algorithms can be changed or added without 
reprogramming or altering any other part of the subsystem. In addition 
new transducers can be added, others deleted, or priority changes made 
without requiring extensive reprogramming. 


Bus Interrogation 

The Bus Interrogation block carries out the process of communicating 
with the bus simulation segment. In Initial phases of simulation it 
has simply been by-passed and processing continues uninterrupted. 

However, the active functions of this block are to test if the subsystem 
has been addressed since last, checked. If so-, communication with 
the appropriate TALKER takes place. . Data is transferred as required 
land, then an ADDRESS event again takes place. Note that the time 
required to respond to a request .for service by the bus varies 
stochastically. The simulation • can evaluate the mean and standard 
deviations of this time. 


Simulation Code 

Appendix II shows the GASP/PLI code for the simulation of this 
subsystem. 


CPS SYBSYSTEM SIMULATION 

While it is true that the CPSs to be simulated are- 
essentially clocked sequential systems, other portions of 
the overall avionics system to be combined with this part 
ulimately, would not have these restrictions. Such a 
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restriction would have resulted in a simplified data 
structure. For instance, it would have obviated the need to 
maintain two sets of values for each signal, the currently 
valid value and the value that it is going to take on later. 
In a general asynchronous system, these two values need to 
maintained if the delay times are to be simulated. However, 
such a restriction would have sacrificed the capability of 
the simulation to handle any asynchronous hardware added, 
and would also have greatly- impaired the accuracy of the 
timing considerations. 

The simulation itself is at the functional units level. 
The major functional unit types, each with defined input and 
output ports, along with a model of the overall operation 
(number and interconnection of the. function types) defines 
the simulation structure. New types of chips, and 
additional structure utilizing any of the functions can be 
readily added. 

The simulation uses a flexible table-driven structure 
to obtain the configuration flexibility mentioned above. 

This table structure is similar in pattern to the one 
described by Szygenda and Thompson®. The simulation 
initially receives the input of time parameters, viz the 
chip function types. If the values are not specified for 
any chip type, a default value of zero is assumed. The 
simulation next reads the total number of chips used in the 
system, as well as the user-defined name and the functional 
type for each chip. Additionally, for each chip, a header 
which defines such quantities as the pointers to the input, 
the output and the time parameters, is created. The input 
list has values for the current inputs, the previous inputs, 
and the times at which the inputs changed. The output list 
contains the current and future values of the output, and 
pointers to the connection table. The reader will remember 
that such value overlap is needed to avoid the serial 
processing conflict associated with simulating simultaneous 
events . 

The connection table designates the interconnections 
made between the chips. This table contains each chip name, 
each output number for the chip, the size of the fanout, and 
the chip name-input pin number list to which each output is 
connected. 

The simulation uses a four value model for signal 
levels. Values 0,1, 2, 3 designate logic 0, logic 1, the open 
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state and the indeterminate state. If the transitional 
phase is represented also during a simulation, then two more 
states, one for the rising edge, and one for the falling 
edge are added. Thus each signal requires a two or three 
bit representation. At the start of the simulation, all 
input and output values are initialized to state 3. This is 
the default value if another value has not been specified by 
the programmer. 

During simulation initialization, asynchronous 
(level-mode) outputs are adjusted to values consistent with 
the initially defined input values. Four major event 
classes may be distinguished: clock rise, clock fall, 

output change, and finally the chip event. The clock cycle 
is started with an initial clock rise or clock fall event 
which then schedules the complementary clock transition 
event etc. for the duration of the simulation. Whenever an 
output value changes, the current values of all Inputs to 
which this output is connected are also changed. If any of 
these inputs function asynchronously on that chip, then a 
chip event is scheduled to occur at the present time, if the 
flag associated with the device has not already been set by 
some other input change. The chip event has the lowest 
priority of any of the events. The sole purpose of the chip 
event is to wait, until all input changes are processed, and 
then to process the corresponding output change event. 
Synchrounous outputs are evaluated at the appropriate clock 
rise or fall time. Once an output is evaluated, an output 
change event is scheduled after the required time delay 
time, unless there is no output signal change. Setup times 
for the inputs are checked at the corresponding clock edges. 
Note that setup time does not have a meaning for an 
asynchronous input. At the time that an input changes, if 
the hold-time for the input is greater than zero for that 
input, a hold clock event is scheduled to occur after the 
appropriate delay. This event checks that the input has not 
changed during the elapsed interval. 

The simulation is halted either by encountering a halt 
instruction, or the simulation end time is reached. Both 
methods are included in the program. 

In the simulation program, the main procedure calls the 
GASP executive. This initializes GASP variables through 
input cards. An initial clock-rise event can be scheduled 
using this. Then a user written procedure is called to 
initialize other variables. Simulation then proceeds by 
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processing events and advancing time. Detailed information about -the CPS 
simulation will be available in the SIU Masters' Degree thesis of ,M. S. 
Jayakumar entitled "Simulation of a Microprocessor Emulation Using GASP/PLI," 
1977. 


CONCLUSIONS 

Time limitations have precluded the use of the simulation models 
as originally anticipated. The CPS simulation is In the process of 
being debugged. Some data has been collected using the Sensor Actuator 
simulation alone but much still needs to be done. The Bus System 
simulation code is still incomplete. Any real evaluation of system 
trade-offs and performance depends on the bus simulation; This Is 
a task that merits additional effort. 

As an example of a simulation run output consider figure- 4.5. 

The parameters under which this run was made are: • 

Total Number of Priority 1 Sensors =5 
Number of Serial Sensors = 3 

Total Number of Priority 2 Sensors = 3 
Number of Serial Sensors = 2 

Total Number of Priority 3 Sensors = 3 
Number of Serial Sensors = 1 

Number of Priority 1 Process Segments = 5 = 7,000 instructions 

Numbef of Priority 2 Process Segments = 3 = 4,300 instructions 

Number of Priority 3 Process Segments '= .2 = 2,800 instructions 

Microprocessor Cycle Time = 5 microseconds 

We see' that under these conditions, the mean time between samples for 
a priority 1 transducer is 57 milliseconds. For a priority 2 transducer 
it is 184 milliseconds and for priority level 3 is 336 milliseconds. The 
evaluation of performance with a variety -of conditions is seen to 
be an obvious extension of this type of run. Such efforts were not 
carried out as time was subsequently devoted to the design of other 
simulation packages, e.g. Bus and CPS. 

In implementing a program for the simulation of a 
digital' processor system, .one of the major tasks involves 
setting up the different tables which hold information about 
the chip types, the interconnections etc. Here the flexible 
data types of PL/I structures are very useful. This 
strengthened the conclusion that the availability of the 
features of a high-level language makes, the task of simulating 
simpler and more direct. 
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*»GASP SUMMARY REPORT** 


SIMULATION PROJECT NUMBER 2 BY GRISMORE ■ 

DATE; JAN 12 77 HUN NUMBER 1 OF 1 

CURRENT TIME = 5.0000E-01 


**STATISTICS FOR VARIABLES BASED ON OBSERVATION** 

mean STD. dev.- S.D. OF MEAN COEF. VAR. MIN. ■ MAX. OBS. 

PRIITIME 5.7080E-02 1.2644E-02- 1.9746Er-03 ■ 2.2151E-01 1.0250E-02 ‘ 6.1860E-02 41 

PRI2TIME 1.8381E-01 7.8374E-02 3.1996E-02 4.2639E-01 6.1790E-02 2.4739E-01 6 

PRI3TIME 3.6591E-01 1.6769E-01 1.1857E-01 4.5827E-01 2.4734E-01 4.8448E-01 2 . 

CNTRTIME 1.0000E-02 O.OOOOE+00 O.OOOOE+OO O.OOOOE+00 1.0000E~02 l.OOOOE-02 30 

^ **GASP FILE STORAGE-AREA DUMP AT TIME 5.0000E-01** 

ON 

MAXIMUM NO. OF ENTRIES IN FILE STORAGE AREA = 1 


PRINTOUT OF FILE NO. 1 
TNOW = 5.0000E-01 

QQTIM = 4.9530E-01 

TIME PERIOD FOR STATISTICS = 0.5000 

AVERAGE NUMBER IN FILE = ',.1.0000 

STANDARD DEVIATION = 0.0003 

MAXIMUM NUMBER IN FILE ’= 1 


FILE CONTENTS 

ENTRY NO. 1; 5.0530E-01 3.0000E+00^ 



Figure 4.5. Sensor-Actuator Simulation Output. 
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SECTION 5 


SYSTEM TRADEOFFS 


OVERALL TRADEOFFS 


Functional capability, cost, reliability, weight, and 
power would seem to be the most important competing 
variables In the system. To increase reliability would in 
most cases increase the other three. It is desired to make 
the numbers for each as small as possible. Since the pilot 
is a part of this system, equipment can be sacrificed until 
the pilot no longer has the ability to fly the aircraft. It 
is crucial to set up a barrier zone about this level of 
system functioning so that failure into this level just does 
not occurr. For a VFR only aircraft, the entire system 
could fail and a pilot could still get the aircraft back 
using visual and acoustical cues. But in IFR conditions, 
regardless of the cost, weight and power penalties, attitude 
information, at the very least must be available. This 
requires that the system bus, central processor, sensor, and 
a sensor feedback subsystem be functioning. If autopilot is 
included, then the display can be sacrificed while the 
autopilot maintains the aircraft attitude. Navigation must 
still be possible to VFR via the autopilot if the display is 
sacrificed. The navigation can be via the communication 
link if flight following is functional, or by ground 
navigation stations if the navigation capability is still 
functional, or in the direction in which VFR conditions 
exist if all else fails. The dual sensor, navigation, 
display, communications, with a triple redundant bus, and 
quad- CPSs seemed a minimum desirable IFR system. Pilots 
venture into IFR with less today, and probably will- in the 
future. Gyros, CPSs and the altitude sensor should be at 
least dual with two from the display, autopilot, or voice 
generation subsystems for IFR flight. This gives attitude 
capability. Then one navigation subsystem perhaps if flight 
to- VFR weather is always an alternative. Since this cannot 
be guaranteed, two from the nav, com-ff, or ground map radar 
group, along with two barometric pressure sensors must be in 
the aircraft for a minimiua navigational capability. In 
controlled airspace one of the two choices must be the comm 
and flight following subsystems. 


ORIGINAL PAGE IS 
OF POOR QUALITY 


So far, the considerations are primarily aimed at 
obtaining a minimal functional capability considering 
reliability. The bus etchings along the motherboard are so 
cheap that no alternative to having three sets of bus etches 
available seems reasonable. The reliability analysis shows that 
a two bus system has a probability of failure which is only 
marginally acceptable. On the other a hand a three bus 
system is consertlvely reliable. The BIM's to tie into the 
three sets of etchings is another matter, and the cost, power, and 
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printed circuit board space required suggests that they be 
as few as possible. This is especially true in the CPSs 
where the controller BIM capability requires a more 
elaborate BIM than on other subsystems. A VFR only pilot 
could perhaps risk one CPS with one BIM which thus uses only 
one of the three buses. But this would almost insure that 
some time or other he would be piloting in the style of the 
Wright brothers. The CPS is a fairly expensive subsystem in 
this system design, but much simpler versions would suffice 
for much reduced system capability. For a minimal display, 
nav, ccanm capability, and little in the way of diagnostics, 
a simple LSI chip microprocessor without the on board mass 
storage could probably be used. It might just use two of 
the three buses as well. In fact, two such CPSs using just, 
two of the buses would be at least as cheap if not cheapper 
than most of the other subsystems because of the mass 
quantities of such chips in use elsewhere. The systems 
would probably be used IFR. In addition to reliability, the 
expansion potential of the system is limited by opting for a 
smaller member in the TOS. Each of the CPSs must be able to 
hold all of the programs which might be run in the system. 

So the final size of the system overall software package is 
set by the smallest member of the team. An endless variety 
of exceptions is possible if a team member always consists 
of two CPSs, one big and one little, or two little, and 
these are treated as the smallest entity. But the system 
variations then become complex for the lOS to set up and 
someone to initially program. The bits traffic also 
increases for such configurations. It would seem best for 
the CPSs to be Initially selected at a capacity level that 
would permit expansion of the system to the fullest level 
expected in that box. The number of slots, and the software 
package that could ultimately be held would be a limit from 
the start for that CPS. The CPS could be swapped out 
however, if the system was expanded. That is, one could 
start with a small CPS, then go to two for reliability 
later. As subsystem slots were filled and the software 
package grew, replace the existing CPSs with faster ones 
having more memory. The overall system capability would 
seem to vary nearly linearly .with the number of CPSs used. 
But reliability, and a relatively simple architecture would 
suggest that the smallest capability allowed for a CPS be 
that papability which is acceptable as a minimum flight 
capability. At least, sufficient CPSs should be in the 
system so that failures never reduce the remaining number of 
CPSs below those needed to provide the minimum overall 
system acceptable processing capability. Although the speed 
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at which tasks can be handled can be Increased by adding 
CPSs, it is still necessary to have storage for all of the 
tasks on each of the CPS boards. Relatively empty memory 
sections could initially be purchased, with these portions 
of the CPS boards filled in later. Power requirements for 
high speed processor capability, must be traded off with 
using more low speed, but low power CPSs. A look ahead 
local OS and a rapid local retrival architecture through 
parallelism, could be used to trade fast memory for slower 
low power, memory while keeping the processor ALU fast. The 
present design was mostly functionally oriented, and with 
additional work it is not doubted that significant 
reductions in power would be possible in the CPSs. 


TRADE OFF COMPARISONS 
• * 


In this section we attempt to quantify some of the trade 
off parameters. This is done by postulating three different 
AAS configurations and comparing cost, weight, performance 
and reliability. The resulting numbers illustrate the effects' 
of system design decisions. In addition to comparisons with 
each other data on the baseline system is included for reference 

The three systems chosen are: 

1) Complete AAS on Cessna 402 

2) Mid-Performance AAS oh Single Engine Primarily VFR 

3) Partial Retrofit, Minimum Capability System 

/ 

The constituent components/'of each system is tabulated in tables 5.1, 

5.2, and 5.3. The originally specified base line system is itemized in 
table 5.4. i 

( 

The cost of each ^S configuration is computed in Section 9. 

Reliability data are tj&en from Section 8. Before specific numbers are 
presented, it is appropriate to clearly define what is herein defined as 
"reliability” and "performance." 

In Section 8 we will categorize failures in three groups; catastrophic, 
hazardous, and nuisance. These names refer primarily to the seriousness 
of failure to IFR flight. In this section, however, we are dealing with 
systems, which have completely different operating profiles. A failure 
which would be catastrophic to an IFR system might be termed only a 
nuisance failure in a partial retrofit system operated in day VFR only. 
Therefore for this comparison we choose a function which is common to all 
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Table 5.1. Advanced Avionics System 1 - Cessna 402 installation. 


Quantity Function 


4 

1 

1 

2 

1 

1 

1 

2 

2 

1 

2 

1 

1 

1 

1 

1 

2 

3 
1 

4 
1 


CPS 

NAV(VOR-DME) 

NAV(VOR-ADF) 

COM 

Flight Following 

Weather Avoidance 

Aural Response 

Sensor Actuators 

Displays 

Mass Memory 

OMNI Remote 

DME Remote 

ADF Remote 

Transponder Remote 

Marker Beacon Remote 

Glide Slope Remote 

Display Panels & Keyboards 

Gyro Pack & Flux Gate 

Throttle Quadrant Actuator 

Remote Stations (Sensor-Actuator) 

Large System Box 

Complete Sensor Complex for Air Data and 
Two 6 Cylinder Engines 



Table 5.2. Advanced Avionics System 2 - Single Engine (Primarily VFR). 


Quantity Function 


2 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

2 

1 


CPS 

NAV (VOR, ADF) 

COM 

Flight Following 

Display 

Mass Memory 

OMNI Remote 

ADF Remote 

Com Remote 

Transponder Remote 

Display Panel & Keyboard 

Gyro Pack & Flux Gate 

Small System Box 

Complete Sensor Package for Air Data and 
Single Four Cylinder Engine 
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ORIGINAL PAGE IB 
OF POOR QUALITY 





Table 5.3. Advanced Avionics System 3 - Partial Retrofit - Single Engine. 


Quantity 

Function 

1 

CPS 

X 

NAV (OMNI, ADF) 

1 

COM 

1 

Flight Following 

1 

Display 

1 

OMNI Remote 

1 

ADF 

1 

Transponder Remote 

1 

Com Remote 

1 

Display Panel & Keyboards 

1 

Small System Box 
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Table 5.4. Baseline System 


Quantity 

Function 

2 

COM 

1 

Area Nav Receiver 

1 

Nav Receiver 

1 

ADF-Transponder Digital Control Unit 

1 

- Transponder & Encoding Altimeter 

1 

ADF 

1 

■ DME 

1 

Weather Radar 

1 

Autopilot System 

1 

Audio Control System & Marker Receiver 

1 

Radar Altimeter 

Full 

EGT 

Full 

CHT 

2 

Fuel Flow 

1 

Fuel Remaining 

1 

Voltage Monitor 

1 

CO Monitor 

1 

Airspeed 

1 

Encoding Altimeter 

1 

Turn Coordinator 

1 

RPM/Dual 

i 

MP/Dual 

1 

Vertical Velocity 

1 

Map Compass 

1 

Anmeter 

1 

OAT 

i 

Oil Pressure (Dual) 

1 

Oil Temperature (Dual) 

I set 

Plheel Lock Indicators 

1 

Vacuum 

1' 

Aircraft Intrusion Alarm 

1 

ELT 

1 

Metal Particle Detector 

1 

Digital Clock 
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configurations, namely Nav. Comparing system reliabilities on 
the basis of Nav reliability is a tenuous proposition. The best 
that can be anticipated is some general feeling of relative 
reliability. More elaborate comparisons between AAS and baseline 
are carried out in Section 7. 

An index for performance has been formulated which attempts 
to quantify a primarily subjective parameter. Yet we propose 
there is a degree of validity to the exercise, -and meaningful 
comparative relations result. The performance factor Fp ,1s 
defined as: 

^p “ £ PlKi 

where Ki = Importance factor of the ith functional ability 

Pi = Performance coefficient of the ith functional 
capability for the particular system under 
consideration 

The functional capabilities .considered, e.g. Area Nav, Weather 
Avoidance, etc., are listed in table 5.5 along with their assigned 
K*s. The K’s are assumed to be universal. They represent the 
"importance" of a function to safe flying. A value of 10 means 
the function is highly important to safe flight, A value of 1 
means that it is primarily a luxury item. Values can be any integer 
from 1 to 10 with the. constant that 

?Ki = 100. 

The values assigned here are an average taken over the assignments 
made independently by several pilots. 

Performance index P.^ is a number quantifying the ability 
of the particular system to carry out the i^h function. The 
value can range from 0 to lO. A performance index of 10 means 
the system performs at or above the capability of a present day 
high performance avionics system. >A value of 0 means the system 
can not perform the function at all. Values between these extremes 
are again subjective judgements. A variety of factors including 
relative reliability, accuracy, flexibility of options, etc. all 
play a role in assignment. No two people would in general assign 
identical numbers over the entire set. Yet, we believe the 
assignments are "ball-park-correct.". The results appear’ to correlate 
well with intuitive evaluations of performance. 
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Table 5.5. Tabulation' of Def in ed Functional Capabilities and 
.their Assigned Index K^, 


i Functional Capability 


1 Flight Planning 4 

2 Area Nav 7 

3 Autopilot 7 

4 Horizontal Situation Display 10 

5 Vertical Situation Display 10 

6 Engine Monitor 10 

7 Communications 10 

8 Weather Avoidance 7 

9 Aural Response 3 

10 Pilot Assistance (Emergency Procedure) 8 

11 Operating Ease (Low Pilot Workload) 10 

12 Pre-flight & System Test 4 

13 Vertical Height Estimation 10 
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Note that Fp is defined such that if .a .given system has a 
performance index of 10 for every function then 

Fp = Z = 10 S Kj^ *= 1,000. 

A "perfect" system has a performance factor of 1,000. 

Table 5.6 lists the values of assigned for each of the 
four systems under consideration. Carrying out the resulting 
summations we find: 

Fp (System 1) =» 960 
Fp (System 2) = 530 
Fp (System 3) = 305 
Fp (Baseline) = 675. 

Figure 5.1 shows data of cost as, a function of performance 
index. The points enclosed in circles arid marked with vertical 
bars are related to the system configurations described above. 

The dotted line indicates an approximately ■ linear relationship 
between cost and performance for an integrated system. Note that 
the baseline system lies well above the cost^perf ormance trend 
line of the AAS. In addition to these data we show results 
adopted from Contract No. NAS2-9067, Final Oral Presentation, 
Hoffman & Hollister, Aerospace Systems Int. Aug. 19, 1976. Using < 
their definitions of Group C, D, and F avionics installations 
we have computed corresponding performance factors. The results 
are: 

e 

Fp (Group F) = 110 
Fp (Group D) = 450 
Fp (Group C) = 600. 

Using their corresponding approximate costs for these systems, 
the data plotted as sequence boxes is obtained. These points 
are .connected with a broken line. The trend indicates' the general 
feature, of rapidly increasing cost for higher performance systems. 
This is apparently due- to the high cost of redundancy in such 
-systems. Such redundancy gives increased reliability but 
introduces little in terms of additional functional capability. 
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Table 5.6. Assigned Values of Performance Index P^. 


Index 

Function 

Baseline 

System 

Full AAS- 
Cessna 402 

Single 
Engine AAS 

Partial 

Retrofit 

1 

Flight Planning 

0 

10 

10 

6 

2 

Area Nav 

5 

10 

6 

1 

3 

Autopilot 

9 

• 10 

0 

0 

4 

HSD 

6 - 

10 

8 

2 . 

5 

VSD 

7 

10 

8 

8 

6 

Engine Monitor 

6 

10 

8 

6 

7 

Comm. 

10 

10 

5 

5 

8 

Weather Avoidance 

10 

. 10 

0 

• 0 

9 

Aural 

0 

io 

0 

0 

10 

Pilot Assistance 

'5 

10 

2 

2 

11 

Operating Ease 

8 ■ 

10 

8 

6 

12 

Preflight & System Test 

1 

10 

6 

1 

13 

Vertical Height 

10 

6 

5 

4 
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SECTION 6 


MODULARITY 


DEFINITION 

Modularity in a system implies a degree of "building 
block" characteristic. A highly modular system excels in 
the ease with which subsystems and software may be added to 
and deleted from the system. This enhances the facility for 
upgrading portions of the system as technology advances. In 
addition, modularity makes it easier to isolate faults in a 
system during maintainence . 

ADVAl^CED AVIONICS SYSTEM 

In this integrated system design, modularity is both a 
hardware and a software discipline. 

Most of the hardware is concentrated in the system box. 
Subsystem modules plug into this system box. The positions 
in which a module may be plugged is nonrestricted. RF or 
multitudes of transducer connections can be mounted at the 
rear of the system box in any position. Similarly, at the 
bottom of the display panel, manual power-reset switches are 
present at every position for whatever use the subsystem may 
need. Normally the smallest width system box would allow a 
minimum of 8 modules to be plugged into it. One of the 
subsystems must be a central processor subsystem. More 
subsystems, including central processor subsystems may be 
added later. A larger system box may be installed at any 
time, with up to 31 positions allowed on each of the three 
buses. Special parameters of the aircraft are located ia a 
ROM on the sensor sensor-actuator subsystem card. Support 
software for the hardware subsystems is located in ROM also 
on the respective subsystem printed circuit boards. The 
remote service modules, which are serviced via dual serial 
buses, may also be added or not, in a modular fashion as the 
aircraft installation requires. The entire system may be 
moved to another aircraft and used only there, taking into 
account the differences in engines, airframe,, etc. Only the 
specification ROM' need be changed. 

System software is also modular. Structured 
programming principles are required.' At the time of 
operation of the initialization operating system, the 
support software is gathered from the ROMs on the 
subsystems, and structured into the local and team operating 
systems. Thus, an improved software package for a fixed 
.hardware module can be installed merely by changing the ROM 
on the subsystem and then running the initialization 
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operating system. Similarly an improved hardware module may 
be installed with the old software merely by using the old 
ROM. The same statements of course apply to the lOS, LOS, 
TOS. In principle, different kinds of CPSs may be mixed, as 
long as the lOS is able to reduce the run time systems to 
the required machine language for each CPS. This can be 
implemented by having standard access to subsystem ROM for 
each CPS, and a recognition scheme built into the lOS and 
subsystems so that it can Identify' the various subsystem 
processors. 

Modularity has been extended to the display and voice 
generation subsystems. The displays are totally general. 
Presentations can be adapted to whatever is required by 
whatever new- subsystems may be instiled or' invented in the 
.future. Similarly, the voice generation vocabulary can be 
software updated. 

BASELINE SYSTEM 

The baseline system was selected as that existing 
general aviation system, which had most advanced toward the 
new concepts studied during this contract. Modularity runs 
counter to integration. It is easy to have modularity if . 
there is no integration. Thus, the integration of the 
integrated system can only approach that of the totally 
unintegrated system by the use of careful organization. In 
the case of the digital baseline system , • it is lightly 
Integrated and fairly hardware modular within the 
manufacturers specific line, but not modular overall. This 
is because it is hard to add into the system beyond the 
basic manufacturers designed in functions, and then only in 
a highly restricted and defined sense. Of course additional 
capability can be added in parallel , outside of" either of 
the systems. By comparison, both systems, baseline and AAS, 
have equal, independent modularity. But the AAS has vastly 
more integrated modularity than the baseline system. 
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SECTION 7 


RELIABILITY 


INTRODUCTION 


Reliability analyses are t3?pically suspect when dealing with large 
systeins. Such suspicion stems from the fact that field data often show 
an order of magnitude or more difference in MTTF than analysis predicted. . 

There are a variety of reasons for the existence of this problem. Sometimes 
the system is simply modeled incorrectly. Subsystem interactions which 
were overlooked or considered negligible may for some reason turn out to be 
dominant. Basic assunq>tions regarding hazard functions or appropriate 
probability distributions may be in error. Often^ accurate component failure 
rate data for the environment and stress levels extant simply does not exist. 

In the analysis that follows an attempt is made to ’'ball-park*' certain 
aspects of the Advanced Avionics candidate system reliability. The analysis 
is kept at the simplest level possible in order to clearly evaluate the 
salient features without the clutter of an elaborate model. Generally a 
signal path analysis is performed. In an adaptive system such as this, the 
techniques by which the system itself sorts out the "good" and "bad" paths 
may play an Important role in overall reliability. However,' at this point in 
the system design the software and hardware details through which such decisions 
are made are not yet known. We have therefore assumed that such decisions 
can be made with a reliability of 100%. As a result, the failure probabilities 
computed become an estimate of the lower bound. Although absolute values 
of failure probabilities must be considered tenuous, they are certainly 
significant in a relative sense. As such, they are useful in Indicating ' 
the relatively "weak" portion of the system and evaluating cost-reliability- 
performance tradeoffs. 


FAILURE MODES 


A fundamental concept in the Advanced Avionics System design is that 
no single failures of any subsystem should cause a hazardous situation. 
The system is fail soft in that as failures occur, all key functions 
can continue to be carried out albeit at lower rates. Successive failure 
may result in dropping tasks on a priority basis. However, the loss of 
all key tasks should be an event of negligibly small probability. 


In light of the above, it becomes difficult to define system "failure" 
in a single probabilistic statement. If part of a display subsystem falls, 
one has a failure. But a failure of this type only requires a redistribution 
of the display format to reposition information to any operable region. 

The aircraft is .able to continue the mission with no significant performance 
degradation. For purpose of simplified analysis therefore we define three 
types or modes of failure. They are catastrophic, hazardous, and nuisance. 
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Catastrophic Failure 

A catastrophic failure is one in which the pilot is left with no 
instrumentation. Such a failure in IFR conditions would normally result 
in loss of control of the aircraft. For the system design of this report, 
these failures can be completely specified. There are five obvious 
ways in which a catastrophic failure can occur. 

1) All CPSs fail 

2) All buses fall 

3) No Information transmlttable from the sensor-transducer 
subsystem 

4) Cos^lete electrical power failure 

5) All display panels fail 

Failure mode (5) might not result in loss of control if the autopilot 
were engaged at the time of failure and if VFR conditions could be encountered 
before a landing was necessary. However, it is difficult to assign 
reasonable probabilities to these events. Therefore loss of all display 
will be considered catastrophic. 

One important concept to emphasize is that these failure modes,' 
although defined "catastrophic" would not of themselves result in control 
loss under VFR conditions. In this system design the pilot has complete 
adcess to all controls as in present general aviation systems. The 
ability to maintain control through visual and audible stimuli remains 
even under complete avionics system failure. Certain failure modes can 
be envisioned in which control is lost momentarily. For example assume 
on take-off an engine failed and simultaneously the autopilot actuators 
failed in such a way as to apply aggravating control pressures. The 
ability to physically override actuator forces, feather a prop, disengage 
the activators and coordinate control movements obviously depends on 
pilot proficiency. Such failures are not evaluated in this analysis. 


Hazardous Failures 

A hazardous failure is defined as one In which the system is reduced 
to "barely operational" status. Enough system remains to safely control 
the aircraft in IFR conditions. 

Listed below are some members of this set of failures. It is 
difficult to exhaustively tabulate the entire set. Therefore we consider 
only a few which may be typical. 

1) Loss of both attitude gyros 

2) Loss of all but one bus 

3) Loss of both tactile input panels 

4) Loss of all radio assisted nav 

5) Loss of all but one half of one display panel 

6) Loss of all but one CPS 


184 



Kulsance Failures 


A nuisance failure is one In which system performance is only 
marginally affected, however pilot workload may increase. 

Again, this is a large set and only a few tj^ical cases can be 
presented. It is to be noted here that in many of these failures, a 
mission can be completed with actually no degradation in performance. 

Of course the conditional probability of subsequently encountering 
a hazardous failure state is increased. 

1) Loss of one CPS on a three or four CPS system 

2) Loss of one tactile input panel on a two panel system 

3) Loss of power bus interconnect 

4) Loss of DME subunit of a nav subsystem 

5) Loss of one attitude gyro 

6) Loss of one entire display subsystem in a two display implementation 

Our purpose in the following paragraphs is to analyze the catastrophic 
failure modes most completely. This established an upper bound on system 
reliability. In addition, sample evaluations of Hazardous and Nuisance 
failure rates will be carried out to indicate the relative probability 
of such occurrences. 


ANALYTICAL TECHNIQUES AND MODELING 


Probability Density Function 

For the purpose of this reliability analysis, a simple constant 
hazard rate model is assumed. Obviously this Implies a neglect of 
"infant mortality" and "end-of-life" failures. On the other hand, 
traditional analysis is often based on such assumptions and hence a 
comparison or relative measure of system reliability results. With a 
Welbali density faction, the results are so dependent on the selection 
of the B parameter that meaningful a priori results are difficult to 
obtain. Selection of the exponential function, i.e. constant hazard, 
peirmits simple evaluation of an intuitively meaningful MITF. 

Another justification for a constant hazard function is based on - 
the anticipated maintenance model. The system posesses modularity at 
the PC board level. Thus, normal maintenance procedure involves replacement 
of a failed board with a new or completely reconditioned unit. Kow 
assume failures are repaired by this process as they occur. The 
reliability function can be thought of in terms of an experiment in which 
a set of new subsystems is started in operation at the same time. The 
reliability function Is the proportion of these subsystems which we 
theoretically expect to be still operation at any time t, provided no 
repairs are made. In this case the number of subsystems at risk decreases 
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as failures occur. If hbwever repairs are made the number at risk would 
decrease. Even If the new subsyston density has an increasing hazard 
rate, it can be shown that a constant failure pattern is approached. 

As the subsystems age and begin to fail the failure frequency rises to 
a peak. With repair, i.e. replacement with new units, the average 
subsystem age tends downward and so does the failure frequency. This 
cycling of age and failure frequency continues, but diminishes and approaches 
a stable state with constant failure frequencies. 


Mission Time 

In general, calculations carried out here predict the probability 
of failure in a mission of specified time. In all cases, the mission 
duration is four hours. 


Models 

The modeling technique used is based on a cut set analysis. 

In this approach a particular failure condition is diagrammed with 
a reliability graph. Graph branches represent physical slgn^ paths 
defined by appropriate combinations of subsystem hardware. Graph modes 
represent signal status. A simple illustration based on figure 7.1 
follows . 

Assume transducer data is available at a signal conditioning subsystem. 
The data is to be processed, then transmitted over one of two available 
buses to the computer. The computer digests the data and transmits 
an appropriate resulting message over bus 2 to a display subsystem. 

The display subsystem decodes the computer generated message arid 
presents a meaningful output S 3 ?mbology to the pilot. Figure 7.1 
is called a reduced system diagram because only those subsystems which 
directly affect the reliability of converting transducer data to display 
information is considered. 

A signal flow graph of the reduced system diagram is shown in 
figure 7.2. Note the branches of the graph correspond to the signal 
moving through the corresponding hardware of the reduced system diagram. 

The minimal cut sets can be found by systematically removing branches 
or combinations of branches in such a way as to prevent the signal from 
node 1 arriving at node 9. A list of the minimal cut sets is given below. 


Xl 

X2X3 

X 5 

X3X4 

X 7 

X3X6 

X8 


X 9 


xio 
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Bus 

Interface 


Bus 1 


Bus 

Interface 



Bus 

Interface 


Display 

System 


Output 

Figure 7.1. Reduced system diagram. 








Cut set X 3 X 6 is diagrammed in figure 7.2 inset.- Note that a combination 
such as X 2 X 5 is a cut set but not minimal, since X 5 is itself a cut set. 
Thus if X 5 = 0 , then X 2 X 5 = 0 regardless of X 2 . 

Now defining Xi = event that path Xj has failed, etc. and 
F = the event that no path exists between nodes 1 and 10 , we can write: 

F = Xi 0T5 OY7 uXg UX9 uXjo <J 0^2 0X3) u (X3 nX4) u (X3 nXg) 

Define Q as the probability that event F will occur. Thus Qp is the 
probability of failure to- get transducer data through the system to be 
displayed. If Qy is small then it can be shown that, 

Of = <?xi + qx 5 + qx 7 + qxg + qx 9 + qxiQ + qx 2 • qx 3 

+ qx3 • qx4 + qx3 • qxg 

Here we have the symbology that qxj = P(^i), i.e.-.the probability that 
path Xj has. failed. Note in the above formulation, it has been implicitly 
assumed that all failures occur independently. This assumption will be 
carried through all subsequent analysis. 

From the above illustration i-t is obvious that Qy will be dominated 
by the single terms. For small q’s the product terms are orders of 
magnitude less than the single terms. System design will be seen to 
have eliminated essentially all single ' terms in the failure probability 
expressions for catastrophic modes. 


•Component Failure Rates 

The failure rate associated with a given subsystem, or section 
of a subsystem, is computed by summing the failure rates of the constituent 
components. Component counts are estimated for each subsystem. Component 
types are broken down into major categories only. Examples Include 
MOS-LSI integrated circuit, printed circuit board, connector pins, etc. 

Component failure rates are taken from Tables 9.11 and 9.13 in ■ Reliability 
Engineering . ARINC Research Corp., Prentice Hall 1965., Ed. N. H.‘ Von Alven. 

In general the data used is taken from column 13 of table 9.11. These 
data were collected by RCA under Air Force contract, and published 
in TR-59416-1. In cases where no data exists la these tables, e.g. hybrid 
electronic packages and integrated circuits, other sources were used. 

Failure rates for hybrids were approximated from data collected in HMRD-0175^^^ 
Hybrid Microcircuit Reliability Data for LSI packages data was used ..from MDR-S^^) 
Microcircuit Device Reliability. • In these latter two cases, fallurp -ratps at- 
C were multiplied- by a stress factor of 5 as suggested in Reliability 
Engineering . op. cit., page 292. 

A tabulation of actual component failure rates used in the analysis 
is given in table 7.1. 
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Table 7.1. Component Failure Rates 


Component 


Failure Rate/lO&hr. 


R^. 


CMOS LSI, MSI (.03) (5) 

0.15 

NMOS or PMOS LSI (.01) (5) 

0.05 

Schottky Bipolar SSI, MSI (.03) (5) 
Hybrid Circuit: 

0.15 

(0.15 X chip count + .02 x 

passive Count) 

Printed Circuit Board 

1.00 

Connector Pin 

0.30 

Crystal, Quartz Oscillator 

0.61 

Capacitors, Ceramic 

0.11 

Capacitors , Electrolytic 

2.21 

Capacitor, Film 

0,20 

Capacitor , Variable 

0.35 

Transistor & Diode (Silicon) 

0.50 

Transf orm-.5rs 

0.40 

Resistors (Composition) 

0.20 

Resistor (Variable) 

1.50 

Inductor 

- 0.50 

Relay 

0.94 

Switch 

0.58 

Coax Connector 

6.0 


1) MDR-3 

2) HMRD-0175 

3) RCA 

4) ARINC 

- Estimated from variety of data. 
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EVALUATION OF SPECIFIC FAILUSE PROBABILITIES 


Bus Failures 

The 488 buses form the communications arteries of the system. 

Total bus failure means total system failure.- ¥e consider here first 
the probability that a single 16 wire bus will fall. It is then easy 
to compute the probability of all buses failing. » 

Assume there are 30 subsystems attached to a given 16 wire bus 
(8 data lines, 8 control lines). Bus failure mechanisms are assumed 
to be; 

1) An electronic component attached to the bus falls pulling 
bus hard up, hard down, or putting garbage continually on 
the bus. 

2) A connector terminal fails causing a short to Vcc or ground. 

3) A printed circuit board failure causes a bus line to open or 
lines to short together. 

Component failures . At each access point, each bus line has 
attached two resistors, an IC Schottky bipolar receiver input terminal, 
and an IC driver output terminal. We assume that 10% of the receiver 
failures will cause bus failures. Similarly, 50% of the driver failures 
will be assumed to cause bus failures. The resistors are assumed to 
be thick film hybrid with a failure rate of .02 x lO^^hr."^. Thus 
the failure rate associated with bus ' attached components is ; 

X = i(30)(16) (0.1 (.15) + 0.5(.15) + .02) x 10-6hr.“^. 

X = 52.8 X 10"6hr.-l. 

Here 30 is the total number of subsystems attached to a bus and 16 
is the number of tie points at a single subsystem. 

Connector terminal failures . The most probable t3rpe of connector 
failure Is the occurrence of a high resistance or open contact. Such 
a failure would not cause a bus malfunction for other units. The 
connectors are however conceived as being terminals soldered into 
a 3 layer backplane containing power, gnd, and bus lines on three 
separate levels. Since the pins traverse the power planes, the potential 
for a contact exists. For such a failure rate, a value of .02 x 10~^ 
is selected', (see ARINC data Table 9.13, Reliability Engineering , op cit). 
Thus contact caused failure rate is estimated at: 

X - (30) (16) (.02 X 10"®) = 9.6 X 10"®hr."^ 
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Printed circuit board . For this failure mechanism we use the 
failure rate assigned to. a single PC board even though the bus slows 
the board with other buses. Thus: 

' X = 1 X 10~^hr."l • 

Probability of bus failure . A failure of any of the above causes 
a total bus failure by definition. Thus we consider the bus in essence 
a serial system. The total failure rate then becomes: 

X = (52.8 + 9.6 + 1.0) X 10"6 = 63.4 x 10“^hr.”^ 

The probability of a single bus fallvire in a 4 hour flight becomes 

q, a 1 _ x 10“®) 

^bus 

%U8 “ 2.5 X 10“^ 

Assuming bus failure to occur as Independent random events, the probability 
of all three buses failing in a single 4 hour flight is simply; 

^bus ^ ^^bus^^ “ 1.6 X 10 

Note that this is indeed a very low probability. On the other hand, 
a two bus system would -have a total failure probability of 6.3 x 10“®, This is 
probably unacceptable for FIR missions. It is at best marginally acceptable. 

It is concluded that a conventional 488 bus scheme with standard 
component technology is satisfactory for this application if the bus 
is triply replicated'. 


Central Processor Subsystem Failure 

The component count and failure rate asstmptions for the CPS 
is shown in table 7.2* Note that the BIM/Time Out hybrid has been 
listed separate from the other components* This is necessary because 
of system calculations similar to the example of section 7.4. There 
is will be recalled the bus interface appears in the signal flow graph 
separately from the main part of the computing subsystem. Note also 
that connector failure rates have been assigned to the BIM/Time Out 
hybrid. This accounts for open or high resistance contact failures 
at the bus tie points. 

If we round the computed failure rate to 2.1 x then 

the probability of a CPS subsystem failure, (exclusive of the BIM/Time 
Out) is: 

qcps - 1 - = 10-5) (4) 

= 8.4 X 10“^ 
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Table 7.2. CPS components and failure rates. 


Qty 

Function * 

Technology 

Complexity X(10“^hr“l) 

1 

CPE, MCU, ICU, TIME 

Hybrid 

13 T^L chip 

2.5 


2 Clock, gate 

10 passive 



1 

RAM 

Hybrid . 

16 chip 

2.5 

18 

ROM 

Schottky Bipolar 

LSI 

2.7 

1 

8 Input MDX 

Hybrid 

16 chip t\ 

2.5 

4 

4 line MUX 

Schottky Bipolar 

LSI 

0.6 

2 

Quad OR 

Schottky Bipolar 

SSI 

0.3 

1 

Hex Inv. 

Schottky Bipolar 

SSI 

.15 

1 

4 bit MDX 

Schottky Bipolar 

MSI 

.15 

2 

8 bit counter 

MOS 

LSI 

.10 

1 

8 bit comparator 

MOS 

LSI 

.05 

1 

Mass memory 

Hybrid 

16 chip CCD 

1.80 

1 

4 phase clock generator 

MOS 

LSI 

.05 

34 

Bypass cap 

Ceramic capacitor 


3.7 

1 


PC Board 


1.0' 

1 

Switching regulator 

Dlscrete-MSI ■ 


3.0 




Xg5s =21.1 

3 

BIM & Time Out 

Hybrid 

16 chip MOS 





32 Passive 




■ 

16 Connect. Pins 
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Note that q « ^t, l.e. 1 - e“ *• = Xt. This relationship is generally 
true if Xt « 1 and can be easily proven by replacing the exponential 
with its Taylor series. The approximation will be used in the remainder 
of the reliability computations without comment. 

Probability of loosing all central processor subsystems . The 
probability of failure- of a single processor subsystem was given above. 
If a system contains N CPS cards then the probability of .losing all N • 
in a four hour flight is 

Qcps “ (‘Jcps + 

Note however than the simultaneous failure of the 3 BIM/Time Out units 
is negligibly small. For the system design proposed in this research^ 

0 < N ;< 4. The tabulation below shows the failure, probability vs N 
tradeoff . 


N 

.Qcps 

1 

8.4 X 10“^ 

2 

7.1 X 10-9 

3.. 

5.9 X 10-13 

4 

5.0 X 10"17 


With at least three processors the probability of losing all processing 
capability becomes negligibly small with. respect to all other catastrophic 
failure modes. 


Sensor-Actuator Subsystem Failures 

One state which can result in a "catastrophic" failure is where 
valid transducer data can not be made available to the system. We 
previously defined -this condition as "loss of all transducer data". 

In this section the definition is restricted to the following: 

Define qgAN probability that data from an operable transducer 

can not be received at CPS unit N. 

A reduced system block diagram illustrating the situation is shown 
in figure 7.3 . We assume tha transducer is providing input at one 
of four possible Remote Stations. As discussed in section 3, each' 
transducer provides a signal to two independent service module units 
each with its own receiver- transmit ter system and twisted pair transmission 
path. Refer back to figure 3.13. Data arrives at the Integrated System 
Package^ l.e. printed circuit board in the system box, and is processed 
in two independent channels. One of the processor units Is designated 
by the CPS to act as talker for the ISP. Should that processor or its 
associated channel fall, the CPS can -request the other processor to send 
data. Each processor has access to all three 488 buses, as do.es the CPS. 
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Figure 7.4 shows the signal flow graph for the transducer data 
problem. ' Hote that serial combination in the block diagram have been 
reduced to single branches in the graph. An example is branch Bi. 

This branch is the path consisting of signal transmission over 488 
Bus 1 and through the CPS BIM connected to Bus 1. A failure in either 
the bus or the BIM is a failure' of that composite branch. Hence the 
failure rate for Bj is the sum of the failure rates of Bus 1 and the 
BIM. 

The value of qg^ is the probability that no path exists between 
nodes 1 and 7. The minimal cut sets for the graph are: 

® 1*2 » > a 2 bxb 2 b 3 , B 1 B 2 B 3 

Therefore the probability of not getting valid data- to CPS (a) is simply: 
qsan “ <I-ai*^a2 + 

Table 7.3 lists a compilation of component count and corresponding 
failure rates for the sensor-actuator subsystem. From this table- 
the branch failure rates are as follows. 

Xai « Xa2 = 6-03 + 2(1.8) + 4.46 « 14.1/lO^hr. 

Xbi “ X|j 2 “ ^h 3 ~ ^cl “ ^c2 “ ^c3 “ 6.9/ 10 hr. 

Xgj = Xb 2 “ ^B 3 “ 63.4 + 7.5 « 70.9/10^hr. 

Thus =%5.64, x 10~^ 

q^j^ = 2.76 X 10“^ 

q®! 2-84 X 10 -^ 

and the total probability of channel failure is: 

'Isan “ = 3*2 * ^0“^ + + 2.3 x 

« 3.-2 X 10/5 

It is easily seen from the above analysis that the failure ■ 
probability is governed entirely by the failure of the subsystem itself. 
Since this is true, the probability of data falling to get to one 
CPS is Identical to the probability that it fails to get to any CPS. 

We therefore conclude that in this system configuration 

Qdata ** ^san ** 3.2 x 10 . 
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Table 7.3. Sensor-actuator subsystem failure rates 


Qty 

Component 

Unit Failure Rate 
per million hours 

Composite Failure Rate 
per million hours 

Service Module 


• 


17 

CMOS LSI 

.15 


2.55 

1 

Quartz crystal 

.61 


.61 

' 17 

Ceramic caps 

.11 


1.87 

1 

PC board 

1.0 


1.0 




^SM ® 

6.03 

RTS 





2 

Bipolar SSI 

.15 


.3 

2 

CMOS LSI 

.15 


.3 

■ 4 

Connector pins 

.3 


1.2 




^RTS “ 

i.'8 

Processor Unit 




11 

CMOS LSI 

.15 


1.65 

1 

Quartz crystal 

.6 


.6 

11 

Ceramic' caps 

.11 


1.21 

1 

PC board 

1.0 

. 

1.0. 

f 



X =» 

pro* 

4.46 

BIM 





2 

MOS LSI 

.15 


.30 

8 

T^L SSI 

.15 


1.2 

32 

Thick film resistors 

.02 


.64 

16 

Contacts 

.3 


4.8 





6.94 
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Here defined as the probability that all transducer data 

is lost. It is noted that with respect to other catastrophic failure 
modes, i.e. total bus failure and total loss of CPS, Qdata easily 
dominate. However, the absolute value is so small that even if the 
number is correct to within an order of magnitude it should be acceptable. 

Here Q^^ta defined as the probability of losing all data 
from a single remote station. This is a significant number because 
of the distribution of sensors among remote stations. Based on the 
system configuration described in this report: 

Qdata ** 3.2 x 10~^ is the probability of loosing 

1) All gyro data (nose mounted remote station) 

2) All left enigne parameter data 

3) All right engine parameter data 

4) All communication with elevator and rudder autopilot 
actuators (tail mounted remote station) 


A brief computation Indicates that the probability of losing 
all gyro data may be undesirably high. Consider the probability of 
losing gyro output, i.e. g 3 n:o failure. The system contains three 
gyros. Two of these are two axis attitude gyros, the third is a turn 
rate gyro. Using ARINC data for gyro failure rate (op. cit. Table 9.11, 
Column 1), ^gyro “ ^94 x 10“6hr,"’I. Thus the probability of losing 
a single gyro in a four hour mission is 


*^gyro 


1.6 X 10^. 


The probability of losing all three gyros is therefore 
Qgyro “ ^ X 10“^. 


It would of course be desirable to have Q^ata Qgyro* 

In this situation the failure probability would be no greater than a 
present day conventional system where no intermediate signal processing 
takes place between gyro and pilot. 


The probability of a complete loss of gyro data in the AAS system 
can be reduced below Qdata* This can be accomplished by separating 
the gyros into two separate remote stations. If one assumes that two 
gyros are in the nose remote station and the third is in the tail as 
failure analysis indicates that 

Qgyj^Q “ 3.2 X 10 

It turns out in this case that the failure probability is dominated 
by the probability of simultaneously losing both processor units. From 
table 9.11 the processor failure rate is found to be 4.46 x 10~^hr”^. 

The value for Qgyro given above follows directly. It seems likely 
that maintenance would be facilitated by having the gyros all in one 
physical location. However, the reduced failure probability is probably 
more significant.. It is therefore proposed that the rate gyro be moved 
to the tall remote station. 
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Communications Failures 

Figure 7.5 is a reduced system diagram for the process of 
communications. Normal operation requires frequency control and mode 
control, data to be transmitted via the 488 buses to the comm 
subsystem. Audio input and output is routed directly from the system 
bdx printed circuit board to' the Audio Subunit. A failure of the 
path from node 1 to 8 would mean an absolute comm failure. A 
failure of the CF to node 3 path would generally mean only a 
partial comm failure. In such a case, no frequency or mode changes 
could be effected. However transmission and reception could be continued 
in a manner identical to that occurring at time of failure. 

For rough-cut-analysis as we are doing here, the assumption will 
be made that even the partial failure discussed above is a subsystem 
failure. We know however from previous analysis that the failure 
probability of the CP-BIM complex (to the right of nodes 6 and 7 in 
figure 7.5) is negligibly small. It is therefore reasonable to collapse 
nodes 6 and 7 to a common node. This is carried out in the signal ' 
flow diagram of the subsystem. 

The signal flow diagram of the subsystem is shown in figure 7.6, 

Note that .path W3, the audio unit, is placed in series as required 
by the previous discussion. Nodes 6 and 7 of the reduced system 
block diagram have been compressed into node E of the flow graph. 

We can define a subsystem failure as an open path from, node A to 
node E. A partial system would be a loss of the path from node 
P to node E with the A to D path remaining complete. It is easy to 
see these are not significantly different numbers because of the 
redundancy between D and E. The minimal cut sets become: 


> ^2 > ^3 » X4*X5- 


The failure rates associated with a COM subsystem are shown in 
table 7.4. The entries of this table can be coaq>ared to those in 
of the Hardware section describing to communicationsy subsystem. 

The probability of subsystem failure may thus be approximated 
as: 

~ ‘Ixi *1x2 ^X3 ^X4*9 x5* 

From the failure rate in table 7 .^ obtain 

qxi “ 4.4 X 10“^ (remote electronics) 

<ix2 “ board electronics) 

^X 3 “ 2.8 X 10“^ (audio subunit) 

*1x4 " *1x5 ” * ^BUS^ = 2.8 X 10“^. 
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■Figure 7.5. Reduced system diagram for communications. 



Remote Electronics Package at antenna 


X 2 System Board Electronics 

X 3 Audio Unit Electronics 

X^, X 3 BIM S Bus Paths to CP Complex 


Figure 7.6, Signal Flow Graph. 
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Table 7.4. Communications subsystem failure rates 


Qty Component 


Unit Failure Rate Composite Failure Rate 

per million hrs. per million hrs. 


Remote RF Unit 


1 Antenna 

.1 

.1 

1 Hybrid 

2.0 

2.0 

2 Hybrid 

1.0 

2.0 

1 Coax connector 

1.0 

6.0 

1 PC board 

1.0 

1.0 

^Remote •“ 

System Board 

6 Connector pins 

.3 

1.8 

3 Hybrid 

1.0 

3.0 

3 MOS 

.05 

.15 

1 Coax connector 

6.0 

6.0 

1 PC board 

1.0 

1.0 

Bus Interface 

2 Hybrid 

6.94 

” . 

Audio Subunit 

10 Connector pins 

.3 

3.0 

4 IC 

.15 

.6 

4 Switches 

.58 

2.3 

1 PC board 


1.0 


^AS “ 6.9 
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The value of the failure probability for a single communications subsystem 
is therefore 

q^, “ 1,2 X 10~^. 

A system containing two independent communications sub systems would 
thus have a probability of total comm loss of 

Qc (qc)^ = 1.4 X 10-8. 

Of course this is not completely accurate because the audio subunit is 
shared. If we consider the single audio unit failure probability to 
domlniate the dual redundancy failure probabilities in a 2 Comm 
subsystem then 

Qc ~ qx3* 

If we take qx 3 = 2.8 x 10“^ as before, the probability of failure is 
relatively high. However, in the previous analysis of qjj 3 any failure 
within the unit was assumed to be catastrophic for the unit. , In reality, 
this situation is strongly compensated for by providing for direct 
headphone output from the comm printed circuit board (see figure 3.47). 

In reality then, the failure rate is limited by that of the mike, hea 
headphones, mike switch, and connecting jacks. Assvimlng the failure rate of 
these components to be negligible then 

qc - 1x10“^ and Qj, = q^^ - ixlO”® for a two comm system. 

Navigation Subsystem Failures 

Consider for purposes of failure rate analysis a Nav subsystem 
consisting of an OMNI-DME combination. We shall assume that useful 
RF navigation update to the Kalman filter is available as long as one 
of the two subunits is working. The reduced subsystem block diagram 
is shown in figure 7.7. Note the DMA channels which couple the units. 

As previously described either processor can act as bus communicator. 

The signal flow graph is shown in figure 7,8. Several characteristics 
are important. First, note that the CPS-BIM network of figure 7.7 
has been compressed into a single node (8) . The arguement for such 
a reduction has been given previously. Secondly, the DMA paths are 
symbolized with a double subscript, e.g. nisneral indicates 

it is in the processor y^ complex. Thus if fails y^^ fails. How 
However the (d) indicates it is a DMA chip, i.e. a. separate chip. 

Thus yzd can fail without y^ falling. There are a large number of 
minimal cut sets for this configuration. They are. 




xiFl » xm » ^I72d 
X271 . X£y2 , X2ys , X2yg 

X3Y2 . X3y3 , X3yg 

*By 2 > ^373 > *Byfi 

*173X2 , xiy3*3 »’*iy 3 *B * ^iyB*2 > ^iyB *3 » ^iys*B 
X3yi*i » *3y2*2 > ^3yiy2 » ’'3yi*2d 
*Byiy 2 » ^Byi* 2 B 
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Figure 7.7. Navigation subsystem reduced system block diagr^. 
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Xj. - Omni Remote RF . ^2 “ Omni Processing X 2 ^ - Omni Processor DMA. 

.‘Yi' --fDME Remote RF Yo - DME Processing Yoj - DME Processor DMA 

^3»^3 ~ BIMs.,‘,‘, XgjYg “ Buses 


Figure 7.8. Nav subsystem flow graph. 









The OMNI and DME subsystems failure rates are given in tables T7.5 
and T7.6. From these data we compute the individual branch failure 
probabilities as given below. 


qxi = 5.0x10”^ qx 2 = 7.6x10“^ 

qx 2 d = .05x10“® 

qyi = 5.4x10“5 = 4.2x10“^ 

qy2d ~ • 03x10 ® 

qx 3 ~ qy 3 = 2.8x10”^ 


qxg ■=. qyB *= 2.5x10“^ 



Based on these parameter values and the previously listed minimal 
cut sets che probability of a Nav failure is: 

qUAV * 2 X lO"®. 

The value of q^jAV probability that the Kalman filter in at least 

one of the two processors is able to get either DME or Radial data (or 
both) and transmit a computed latitude-longitude position to the CP. 

The resultant position computation might be very accurate or only 
moderately accurate depending on a variety of conditions. For example 
if the OMNI RF unit failed and only one DME station was within reception 
range, it is probable that one might expect rather large errors. Still 
the result is better than dead reckoning and we can Indeed say that radio 
assisted navigation is still extant. Under failure conditions as above 
but with two stations available, quite accurate position calculation fixes 
are possible. This is a string feature of the frequency switching 
subsystem design. 

Assviming the total Nav complement consisted of two units with 
failure probabilities similar to that computed for the OMNI-DME, the 
probability of losing all radio assisted navigation is 

Qnav = 4 X 

This is negligibly small when compared with other system failures. 


Flight Following (Transponder) Failures 

The transponder subsystem is essentially a serial sequence of 
electronic modules. Thus, except for the BIMs, a single component 
failure may be assumed to cause subsystem failure. Table 7.6 lists 
the component failure rate for this subsystem. Hegllcting the probability 
of simultaneous failure of both BIMs we compute the failure probability 
of the system as: 

qpF “ ^FF*^ = 9 X lO"-^. 
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Table 7.5. Omni subunit failure rates. 


Qty 

Component 

Unit Failure Rate 
per million hours 

Composite Failure Rate 
per million hours 

Remote Unit 


< 

1 

Antenna 

.5 

.5 

2 

Hybrids 

2.0 

4.0 

1 

Ceramic filter 

1.0 

1.0 

1 

PC board 

1.0 

1.0 

1 

Coax connector 

6.0 

6.0 

Xru - 12.5 x 10-6 

Central System Mounted Signal Processing 


1 

Coax connector 

6.0 

6.0 

1 

PC card 

1.0 

1.0 

5 

Hybrids 

2.0 

10.0 

1 

Hybrid 

1.0 

1,0 

7 

MOS LSI 

.05 

.35 

1 

Crystal 

.61 

.61 




19 X 10-6 
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Table 7.6. Flight following subsystem failure rates 


Qty 

Function 

Unit Failure Rate 

Composite Failure Rate 

Remote Unit 



1 

Mtenna 

.5 

.5 

11 

Quartz crystal 

.61 

.61 

2 

Hybrids 

2.0 

4.0 

1 

Hybrid 

1.0 

1.0 

1 

PC board 

1.0 

1.0 

1 

Coax connector 

6.0 

6.0 

K 

Main 

Board Signal Processing Unit 


1 

Hybrid 

2.0 

2.0 

6 

MOS-LSI 

.05 

.3 

1 

Coax connector 

6.0 

6.0 

1 

PC board 

1.0 

1.0 

Total Xs = 22.41 
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Pover System Failures 


A review of the power system will show that total failure can occur 
in one of the following ways. 

1) Open circuit in the battery to power plane link. 

2) Inter plane short in the system multi-layer mother board. 

3) Simultaneous avionics battery short ans S2 switch failure. 

4) Simultaneous protect/regulator failure and switch Si failure. 

We assume that with proper design the following failure rates can be 
achieved. 


Power Plane Connector & Link 
Inter Plant MLB Short 
Avionics Battery Short 
.Protect/Regulator Failure 
Switch Failure 


Al 

Amlb 

Aba 


Jr 

As 


= .1 X 10“9 
.1 X 10 "® 
= 1 X 10 “^ 

= 1 X 10 “^. 
= .1 X 10 "° 


Based on the failure mechanisms defined above (1) through (4) we have: 


4Xt 


qi 

^2 

q4 = (4Xj^)(4Ag) 


r^-9 


^ ..4 X 10 

^aSlb “ *4 X 10“9 
“ (4Xba)(4Xs) = 1.6 X 10,^ 

1.6 X 10"^0 


,-10 


The total failure probability approximated as the sum of q^ through 
q 4 becomes 


Qpwr Sys “ -1. 1 X 10^ 

Display subsystem failures . The appropriate reduced subsystem 
block diagram, and flow graph are shown in figure 7.9 and 7.10. The 
cut sets are obvious from the latter figure. Thus: 


<Idls “ qxi*qx 2 + 5x3 5x4* 5x5* 

In this case the product terms are not negligible with respect to the 
single term qxg. Table 7.7 compiles the failure rate data for the 
various units within the display subsystem. From that data we can 
conqpute the q*s above. 

qxi = 4 (Xbus + ^BIM + Apjjg) = 4(63.4 + 6.94 + .05) x 10”^ 

“ 2.8 X 10“^ 

5x3 " ^^^pu “ ^(2.06 X 10“®) = 8.2 x lO"^ 

5x4 " ^(ApDc + 2 Xjjj + Xpg + X^p) 

«4(.05 + 92.4 + 63.5 + 20) x 10"® = 7 x lO"'^ 


From, these . numbers we predict that 




5DIS- 


8.8 X 10 


,-6 
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Figure 7. ,9, Display subsystem reduced block diagram. 
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Figure 7.10. Display subsystem signal flow graph. 
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Table 7.7. Display subsystem failure rates 


Unit Failure ^te Con^osite Failure Rate 

Qty Component per million hours per million -hours 

Processor Unit ' 


.9 

•MOS .LSI 

.05 

.45 

. 1 

Quartz crystal 

.61 

.61 

1 

PC board - 

1.0 

1.0 

Xp][j = 2 • 06 

Line 

Driver Unit (Hybrid) 



256 

Bipolar transistor 'chips 

.15 

38.4 

300 

Thick film resistors 

.02 

6.0 

19 

MOS LSI 

.05 

1.0 

5 

Bipolar SSI 

.15 

.8 


^LD “ ^6*2 


Power Supply 

Sustainer Unit Hybrid 


5 

Bipolar SSI 

.15 

.75 

10 

Transistor chips 

.15 

1.5 

30 

Resistors, T. F. 

.02 

.6 


2.5 


LV Regulator 


I Transistor .5 

1 T^L MSI .15 

5 Resistors .20 

1 Cap, Electrolytic 2.21 

3 Connector pins .3 


.5 

.15 

1.0 

2.21 

.9 

4.76 


HV Converter/Regulator 


1 

Transformer . 

4.0 

4.0 

3 

Transistors 

.5 

1.5 

4 

Diodes 

.5 

2.0 

3 

Capacitors, _ electrolytic 

2.21 

6.63 

10 

Resistors 

.2 

2.0 

3 

Connector pins 

,3 

.9 

1 

PC board 

1.0 

1.0 


X « 17.03 
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Tatle 7.7. Continued. 



Unit Failure 

Rate 


Composite Failure Rate 

Qty Component 

per million 

hours 


per million hours 

Display Panel (either half) 





1 Panel assembly 

10.0 



10 01TTF=100,000 hrs.) 

512 Edge connections 

— 



10 




Xdp =■ 

20 ' ' 

Tactile Unit 





30 LED 

.5 



15.0 

30 Photo tran 

.5 



15.0 

6 MOS LSI 

.05 



.3 

38 Connector pins 

.3 



11.4. 

1 PC board 

1.0 


■ 

1.0 



X = 

1.3 + 


Keyboard Unit 





12 Switches 

.58 



6.96 

2 MOS LSI 

.05 



.1 

8 Connector pins 

.3 



2,4 

1 PC board 

1.0 



1.0 

X = 9.46" 


Note: A single power supply complex consists of 

1 sustainer unit, 2 LV regulator units and 
3 HV converter /regulator unit. The total 
power supply failure rate is therefore: 

Xps = 2.9 + 2(4.76) + 3(17.03) 

Xps = 6,35 per million hours 
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The value is the probability of losing both halves of 

the display, i.e., the probability of total display failure. The 
probability that one half of a total panel will fail is much higher. 
To the first order this probability is equal to qx 4 >. Thus If qj)/2 
the probability of losing half of our panel we can write 

qo/2 “ 7 * 

As previously defined this would constitute the probability of a 
"hazardous failure in a single display system. In a two display 
system it is a nuisance failure. 


COMPOSITE FAILURE PROBABILITIES ■ 


It is now possible -to compute the probability of catastrophic 
failure. In addition trade<K>ff studies can be made for various system 
configurations. 


Catastrophic Failure 
Define:- 

Advanced Avionics system catastrophic failure . • 

QqP “ probability of losing all CPS subsystems 
Qd =' probability of losing all display 

QsA = probability of losing all sensor/actuator functions 

Qb “ probability of losing all buses 

Qpg » probability of losing all electrical power 

then “ QcP + Qd + QsA + Qb "*■ QPS* 

We have previously found that given N as the total number of CPS units 
in the system then: 


N 

1 

2 

3 

4 

Qcp 

8.4x10“5 

7 . IxlO'"® 

BEfitSa 

5.0xl0*^'i7 


The probability of display failures can be summarized as follows. If 
N is the number of display panels in the system then: 


N 

1 

2 

Qd 

8.8x10“6 

7.7x10-11 

Qtac 

1.5x10-6 

2.3x10-12 


9.5x10-6 

9xl0”ll 
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Note that we have included the probability of losing all tactile ftinctions 
QtAC probability of losing all keyboard functions Q^. 

The probability of losing all sensor-actuator functions is equal 
to the probability of simultaneously losing both processing units in 
the sensor-actuator subsystem. This was previously shown 
to be equal to 3.2 x 10“^*^. Thus 

Qg^ = 3.2 X 

The probability of losing all bus transfer capability was 
previously calculated as : 

*^BUS “ X 10 

This assumed three buses, a number Independent of all system variants. 

Finally, we have projected that the power system failure probability 
is 

Qpg “ 1.1 X 10 

Given the Cessna 402 version of the AAS, the probability of a 
catastrophic failure becomes 

OCAT = 5 X l(rl7 + 7 ./"^ 10-11 + 3.2 x- 10-10 + 1.6 x 10"^1 + 1.1 x lO”^ 
= 1.5 X 10-9 . 

r 

It is likely that an analysis of this type is very optimistic. However 
even if the result is" off by a factor of 4 or 5 it seems quite acceptable. 

A brief analysis of-=’' potential mechanical failure rates indicates that 
the avionics failure probability is perhaps still 2 orders of magnitude 
smaller than engine loss ‘probabilities. 

It is Interesting to note that the area of most significant reliability 
problems is that of the power source. Perhaps our estimates were overly 
pessimistic there. On the other hand, additional design effort in this 
area coiild make a significant Improvement in reducing the probability 
of catastrophic failure. 

Baseline system, catastrophic failure . A detailed analysis of the 
baseline system reliability has not been carried out. However, the 
sources of catastrophic failure centered in the avionics and Instrumentation 
are fairly easily identified. 

There appear to be no situations where the failure of one component 
could constitute catastrophic failure as we have defined it. Similarly, 
no two simultaneous failures should result in loss of control. At the 
level of three simultaneous failures catastrophic failures first appear. 

The most prominent example is; 
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Autopilot System - Artificial Horizon - Turn Coordinator. 


Perhaps the combination of air speed indicator, altimeter, and 
autopilot system could also approach the concept of catastrophic loss. 
In any event , the first combination appears to dominate all three 
element failure combinations because it is gyro based. 

We therefore assume the probability of catastrophic failure for 
the baseline system. Qhase product 

Qbase = ^auto’^AH’^lTC- 

Here the subscripts stand for autopilot, artificial horizon and turn 
coordinator. If the MTTF of the autopilot system is assumed to be 
2,000 hrs then 

^auto ~ ^2x10^^ ^ 2x10 

ARINC failure rate data for gyros shows 

gyro = 394 X 10”^."^. Thus 

9AH = ’9tC " (4)(3.94x10“*^) = 1.6 x lO”^. 

Thus to a first approximation ' 

Qbase “ (2 X 10“^) (1.6 x 10“^)^ = 5 x 10^^ . 


Baseline & AAS Comparison. The failure rates computed above tend 
to indicate that the probability of catastrophic failure for the new 
system is no worse than the present system. The approximations made 
should be noted. Present day systems, from a catastrophic point of 
view, are component limited. Basically that means gyro reliability. 

The AAS uses a gyro complex essentially identical to the base line. 
Therefore we can not expect it overall to be any better. However, 
the value of catastrophic failure probability calculated, i.e. 

OcAT = 1*5 X 10~5 does not include the effects of transducer failures. 

It includes only the failure probabilities of the system which couples 
the transducers to the pilot and airplane. The reason for this form 
of calculation is to clearly identify the failure mechanisms and 
magnitudes of the basic electronics package. Within the next decade, 
-transducers are likely to change drastically. Perhaps the research 
at Ames and Stanford studying the use of accelerometers will provide 
a viable alternative to gyros. 

What we have shown here is that the projected Advanced Avionics 
System structure is highly reliable. It has been designed -so that 
failure probabilities are dominated by available transducers and not 
the system itself. Areas of possible improvement are clearly identified. 
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A decrease of catastrophic failure probability by a factor of 10 to 

100 appears reasonable. For the present such efforts are not considered 

necessary. 

Consider now the case of some hazard and nuisance failures. Baseline 
system failure rates are estimated by extrapolating computations 
made on a nav-com receiver. Although this is not a part 
of the baseline system, the technology is somewhat similar. The component 
count for this unit along with associated failure rates is given in table 
7.8. We find a total failure rate for the box to be X = 2.6 x 10~^. 

This corresponds to a nominal MTTF of 3,800 hrs. Although this is 
probably larger than that experienced in the field, it is obviously 
in the ball-park. Some confidence is thereby gained in the component 
failure rate magnitudes being used. About half the box is associated 
with comm. Nav functions take about half the box plus the electronics 
and mechanics in the display head. Based on these approximations we 
postulate: 

^comm “ 1.3 X 10~^ 

^omni = 2.6 X 10”^ 

We assume an ADF to be about half as complex as an omni nav unit. 

A, DME at least 1.5 as complex, and a transponder approximately equal 
to the NAV. Hence let 

^ADF ~ 1.3 X 10“^ 

^DME = 3.9 X 10“^ 

Ajjp = 2. 6 X 10“^ 

Given a system with dual OMNI and dual COMM, plus ADF, DME, and 
transponder, the following failure probabilities can be estimated. 

Probability of losing all comm: Qcomm “ ^'^comm)^ = 2.7 x 10”^ 

Probability of losing effective radio assisted Nav: 

Qniv “ qoLi-'lADF = (1 ^ 10-3)2(5.2 x 10"^) 

Qnav = 5.2 X 10-10. 


The above value does not include a DME failure. Of course some 
Information is available via DME only. It could be argued that total 
nav failure should Include the DME. Given this case 

Qnav ” 9o^i’9ADF’‘3DME = (1 x 10-3)2(5.2 x 10“^) (1,6 x lQ-3) 

Q^ll = 8.3 X 10-13 

Loss of area nav capability can occur by losing the area nav computer, 
the dedicated Omnis or the dedicated DME. Thus 

Qarea nav ^ 9omni + <lDME “ 4(6.5x10-^) = 2.6xl0~3 
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Table 7.8. • Nav-Com set failure rates. 


Qty 

Component 

Unit Failure Rate 

Composite Failure Rate 

123 

Transistors and Diodes 

.5 

61.5 

247 

Resistors 

.2 

49.40 

280 

Ceramic caps 

.11 

31.0 

10 

Mylar caps 

.2 

2.0 

11 

Electrolytic caps 

1 

11.0 

26 

Inductors 

.5 

13.0 

8 

Variable resistors 

1.0 

8.0 

7 

Variable caps. 

.35 

2.3 

20 

T^L bipolar IC 

.15 

3.0 

9 

Crystals 

.6 

5.4 

38. 

Transformers 

.3 

10.4 

2 

Coax connectors 

6.0 

12.0 

.42 

Terminal pins 

.3 

12.6. 

5 

PC boards 

1.0 

5.0 

1 

Relay 

.3 

.3 

7 

Switches 

5.0 

35.0 


261.9 


X = 261.9 X 10-6 = 2.6 X 10“^ 
MTTF = 1/X = 3800 
Q « 1 _ e-(2.6xl0-6)(4) , 1 ^ io-3 
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Note that in neither of* the above cases includes any area nav capability 
nor includes the failure probabilities of area nav hardware* 

The table below compares the AAS system with these figures* 



Lose all 
COMM 

Lose 
area Nav 
capability 

Lose .all 
radio 

assisted Nav ■ 

Conventional Svstem 

J2. 7x10-7 

2.6x10-3 

8.3x10-13 

Adv. Avionics Syst. 

1.4x10-8 

4x10-18 

4x10-18 


Note that in these cases the the AAS is significantly better in 
projected failure probabilities. This results from use of hybridization 
and LSI to reduce component count and increased redundancy. The 
redundancy is apparent in the navigation system where two subsystems 
provide four redundant systems when used with the Kalman filter 
software. 

An important feature- of the proposed AAS is that improvements 
in devices can be directly incorporated into one subsystem without 
altering other subsystems. The overall system is adaptively dynamic. 
It*s modularity permits easy restructuring to the most optimum 
configuration of cost-reliability-performance. 
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SECTION 8 


SYSTEM INSTALLATION ANB MAINTENANCE 


INTRODUCTION 


Maintenance of the avionics system will be treated as two different 
ai;ea8 of service. These areas deal with all aspects of the total systems 
and the repair of subsystems respectively. 


SYSTEM LEVEL SERVICE 


The first, and most complicated area, consists of total system 
installation, calibration-, and maintenance. 


Installation 

New system installation is usually accomplished by the aircraft 
manufacturer or at an approved repair station. The aircraft manufacturer 
installs the system as the aircraft is being assembled by using kits designed 
for the specific aircraft. This installation consists of the basic system, 
to which any subsystem option can be added either at that time, or later. 

When a. new system is installed in a new aircraft at an FAA approved repair 
station, the installation can be made to -fit the requirement of the owner/ 
operator of the aircraft. The owner has the option of selecting from any 
manufacturer (such as King, Narco, Bendix, Collins) components for the 
system. As an example, from Narco, one might select a NAV subsystem. From 
King, one might select a COM subsystem. From Bendix, one might select 
the sensor/ actuator subsystem. From Collins , one might select the display 
subsystem. This gives the owner additional versatility in selecting the 
individual components to make up the individualized system. For an 
aircraft that is already in service at the time of the advanced avionics 
system availability, installations may be total or partial retrofits. In 
the total changeover, all of the existing avionics and instrumentation 
would be removed from the aircraft. A new panel would be designed to 
accommodate the systems box and the two flat panel displays. All new wiring 
and interconnecting cables would be installed from the systems box to the 
sensor/actuator subsystem, to the RF units, and to the aircraft sensors. 
Careful consideration must be made in determining the location for each of 
the remote mounted units, and the routing of the cable between the systems 
box and the remote mounted units.. In the partial retrofit, only a portion 
of the existing avionics and instrumentation would be removed, A small 
systems box would be installed and probably only one flat panel display 
unit would be installed. The remote sensors and actuator system may or may 
not be Incorporated in the partial retrofit sys.tem. . After the basic system 
is installed j the owner has the option at a later time of removing the 
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remainder of the avionics and instrumentation and adding to the basic 
system to bring it up to any state of full-system reliability and capability 
that is desired. Because of retrofits and differences in aircraft size, 
the main systems box will be available in several different widths so that 
maximum use can be made of existing space. 

Antenna installation on both the new and retrofit will be of prime 
Importance in that the KP units will be. either located in the base of the 
antenna or will be located very close to the antenna. Care must be taken 
so that the RF unit is shielded from outside interference and is in a 
position to provide easy removal and reinstallation by maintenance 
personnel. The navigation antenna will still have the capability of 
furnishing an input signal to two nav receivers and a glldeslope receiver 
as it is used in some present-day aircraft. If it is desired, two nav 
antennas and a separate glldeslope antenna can be Installed so that each 
unit has its own antenna. Examples are shown in Figure 8.1 and 8.2. 


Calibration 

Calibration of a new or retrofit system will require the programming 
of the system for all of the maximum and minimum acceptable performance 
standards for aircraft and engine. For example, depending on the engine 
or engines on the aircraft, the maximum and minimum standards for oil 
pressure, oil temperature, fuel flow, EGT, cylinder head temperature, 
carburetor throat temperature, etc. are required. These are different 
depending on the engines and the manufacturers. These Individual engine 
standards can be entered into the system by setting the sensor/actuator 
subsystem to the calibrate mode, and feedint the data into the system either 
manually from the display panel or from the magnetic tape cartridge reader. 
This standard data would then be stored on an EPROM in the sensor/actuator 
subsystem. Thus, this one EPROM is peculiar to this one aircraft '•s 
engine (s). Calibration of the air frame system would consist of feeding in 
such data as landing gears up and down max speeds, max flap speed, stall 
speed, max air speed, and other pertinent data that would be peculiar to the 
air frame that the system is Installed in. If the unit had to be changed 
because of a malfunction, then the re-programming of the EPROM on the 
new unit would be accomplished at that time by the technician who Installed 
the new or repaired unit in the aircraft. Calibration of the other subsystems 
would follow the same general procedure. For example, the VOR system would 
have to be checked and calibrated for accuracy. The glldeslope, the LOG 
system, the DME system, and the remote compass system would all require an 
EPROM on their subsystem card that could be programmed to accept the 
calibration of their individual systems. 


Maintenance 

Total system maintenance can be enhanced to an optional self-test system. 
This would include a remote mounted RF unit and antenna or antennas on the 
aircraft. The RF transmitter would be a low-powered harmonic generator. A 
single card in the main power unit would contain two or more oscillators 
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Figure 8.1. Location of remote units in t 3 rpical Cessna 402 installation. 
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All antenna and RF units removal and replacement accomplished outside the aircraft , . except glldeciSlope 
and radar. Glide slope RF unit and antenna mounted to bulkhead in radar dome and removed as one unit, 
glide' slope may be located with Nav RF unit and use Nav antenna, radar antenna in radome, RF unit 
should be behind antenna in radome but if room does not permit it will be just on the aft side of 
bulkhead . 
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that could be activated by the central processor. Output from the oscillators 
would modulate the EF unit to furnish a transmitted signal to test the 
communication receiver for sensitivity, squelch, and selectivity. The 
nav receiver can be checked for sensitivity and selectivity. Output from the 
nav receiver can be used to check the VOR and LOG converter for accuracy of 
the comparator circuits. The ADF would be checked for sensitivity and 
accuracy. The marker beacon can be checked for sensitivity. The glideslope 
receiver can be checked for sensitivity and accuracy of the converter. 

If the self-test system is not installed or if a portion of the system 
has a reported malfunction, line test equipment will be required to determine 
which portion of the system is causing the malfunction. In the case of a 
malfunction in the communication or navigation subsystems, line test 
equipment like the IDF 401L and 600 can be used to simulate the ground 
station to check out COM, VOR, LOG, GS, MKB, DME and transponder systems. 

In the case of a malfunction of remote sensors or the sensor and actuator 
subsystem, special tests or test equipment will need to be developed to help 
the technician determine which unit is causing the malfunciton. In the case 
of a central processor failure, a special diagnostic program can be developed 
and used as a self -test program to determine which card will need repair. 
Larger avionics shops will have on hand both replacement cards and remote 
units, and will be able to use a substitution method as an aid in trouble 
shooting the system. The pilot/owner would be able to remove and replace 
cards in the panel-mounted units , but may not have the required equipment 
to remove the remote units. 

Technical training of the technician so that he can locate and repair 
the malfunction in the aircraft, will require specialized training in the 
area of system trouble shooting and an introduction to computer programming. 
This will enable the technician to Isolate the malfunction to a single 
board or subsystem. This will be of particular importance to the smaller 
shops that do not have a stock of boards and subsystem boxes to use. in 
a substitution method of system trouble diagnosis. 


SUBSYSTEM REPAIR 


The second area, bench or shop repair of cards or subsystems removed 
from the aircraft for repair, should be as easy or easier to repair than 
the avionics equipment flying at the present time. This second area 
requires technical skills and training of about the same level as the’ 
present-day technician, who typically has two years of avionics school 
training and some field experience. The communication and navigation systems 
will require the same general test equipment in use in avionics shops at 
present. A list of the required shop test equipment is shown in table 
8.1. To operate the subsystem on the bench for testing, calibration and 
repair, a BIM interface will be required to select correct mode, frequency, 
input and output data. With the use of large-scale integration containing 
4, 6, or more standard chips, the number of required tests to narrow a 
malfunction down to a single chip is minimized. 
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Table 8.1. 


Shop Test Equipment 


1. SHF signal generator, frequency range 450 mHz to 1230 mHz. 

Shop use. Example H.P. 612A $3600.00. 

2. VHF signal generator, frequency range 10 mHz to 480 mHz. 

Shop use. Example H.P. 608E $4500,00. 

3. HF signal generator, frequency range 50 kHz to 65 inHz. 

Shop use. Example H.P. 606B $3500.00. 

4. Audio frequency generator. Shop use. Example H.P. 204C $400.00. 

5. Digital volt-ohm meter with a minimum of 4-1/2 digits. Shop and line 
use. Example H.P. $500.00. 

\ 

6. Vacuum tube volt meter with radio frequency probe with an upper 
limit of no less than 400 mHz. Shop and line use. Exaimple 
H.P. 410C $820.00. 

7. Oscilloscope with a frequency range up to a minimum of 200 mHz. 

Shop use. Example Tektronics 475A $3300.00. 

8. COM/NAV signal generator. Shop and line use. Example TIC T12A 
(with a glide slope head). Exan^le IFD 401L. $7000.00 approx. 

9. DME/Transponder signal, generator. Shop and line use. Example 
TIC 14, 15, and 16 (bench). Example IFD 600A (flight line) 

$7000.00 approx. 

10. * Frequency counter which will accept both square and sine wave 

input, and has no less than 550 mHz upper frequency limit. Shop 
use. Example H.P. 5300B and 5303B. $1285.00. 

11. Stormscope and/or radar test set. Shop use. $8500.00 approx. 

12. BIM Interface to test boards and subsystems on the bench. 

$1000.00 approx. 

13. Logic analyzer. Shop use on microprocessors. $12000.00 approx. 


TOTAL COST: 


$53,405.00. 



The shop, with all necessary support equipment and a stock of parts, 
will be able to repair all the subsystems including the computer cards. 
Some specialized training in computer maintenance will be required. 


Scheduled Avionics Maintenance 

It is not suggested that a single maintenance plan be established for 
all types of aircraft or for all kinds of flying. Rather, it is suggested 
that as a minimum procedure, when any part of the system has failed, the 
complete system be automatically line tested in compliance with factory 
specifications before the aircraft is returned to service. From this 
minimum plan a more complex plan may be implemented for more sophisticated 
aircraft, and/or operations, in which the entire system may be checked at 
every 100 hour inspection. There will be a few components in the system 
that have both a maximum time in service established and a schedule, for the 
replacement of these components. The battery would be one example for which 
a maximum time in service would be established. 

The avionics system 12 volt DC battery will need to be set up on a 
maintenance schedule to be replaced every 250 hours of operation or 24 
calendar months, whichever comes first. This would help to eliminate a 
possible power failure while in IFR conditions. 

Another example would possible be actuators or actuator clutches. 
Further study in this area would be required to collect the data to set 
a definite time in service for such components. 


Avionic Maintenance Cost 

Shop labor rates across the country vary from approximately $15 to $35 
per hour. These rates are based on a technician rate ranging from approxi- 
nmtely $4 to $15 per hour. The total cost of repair would include labor 
arid parts, or labor and unit or board exchange price. The cost of parts 
would vary considerably depending on the complexity of the failed component. 
The exchange price would of necessity take into account the cost of the 
most expensive component or components contained in the unit. The most 
profitable operation for the avionics shop, if voltme allows, will be to 
stock the cards and remote units, then remove and replace these units on an 
exchange basis with both the aircraft owner and the factory. This type of 
operation will require a minimum of bench test equipment and bench 
technicians. It would also allow the shop to give an exact quote on the 
cost to repair a board or remote tinit. However, this may not be the most 
economical procedure for the aircraft owner.. For example, if the exchange 
price on a board was $100 and the only item on his hoard that was defective 
was a 50c cap, the labor to isolate the malfunction should not cost anywhere 
near the $100 exchange price. 

Figure 8.3 shows an avionics maintenance flow chart followed by a list, 
of estimated repair times. This can be used to estimate the limit of 
system down times under different malfunction and shop capability conditions. 
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Advanced avionics maintenance 


flow diagram. 











Item 


1. Time to bring system on line and perform necessary self-test (15-30 
minutes estimated time) . 

2. Anytime a system component is removed and replaced, a complete 
system check should be performed to insure the entire system is in 
airworthy condition (15 minutes to 2 hours estimated time).. 

3. Depending on the complexity of the card, or remote unit, the available 
test equipment and the ability of the technician will all have a 
bearing on the amount of required repair time (1 to 6 hours estimated 
time) ♦ 

4. Time required will depend on amount of line test equipment required, time 
to set up the test equipment and the number of tests required to isolate 

t malfunction to a card or subsystem (1 to 2 hours estimated time). 

5. After a malfunction in a subsystem has been confirmed, the subsystem 
will require testing to Isolate the malfunction. This may include 
disconnecting and testing KF cables, wiring, antenna, RF units, remote 
terminals, actuators, sensors, system box cards, and the displays. 

(15 minutes to 4 hours estimated time). 

6. Items returned' to the factory for repair or exchange will require both 
shipping time and factory turn-<^around time (1 day to 1 month estimated 
time) . 


ESTIMATED DOWN TIMES 

EXAMPLE I - Self Test Isolates Malfunction to Card 


© Remove and replace card 
© 15 minutes to 30 minutes 

© 1515 minutes to 2 hours 
ESTIMATED 

TOTAL 'DOWN .5 hr to 2.5 hrs 
TIME 


© Shop repair of card 

15 minutes to 30 minutes 
15, minutes to 2 hours 
1 hour to 6 hours 
ESTIMATED 

TOTAL DOWN 1.5 hrs to 8.5 hrs 
TIME 
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EXAMPLE IX — Self Test to Isolate Half iirxct ion Use Line Test Equipment 
IB Isolate to Card 


0 Remove and replace card 0 Shop repair of card 


15 minutes to 30 minutes 

© 

15 minutes to 30 minutes 

0 1 hour to 2 hours 

© 

1 hour to 2 hours 

15 minutes to 2 hours 

© 

1 hour to 6 hours 

ESTIMATED 

TOTAL DOWN 1,5 hrs to 4.5 hrs 

© 

15 minutes to 2 hours 

TIME 

ESTIMATED ■ 

TOTAL DOWN 2.5 hrs to 10.5 hrs 
TIME 


EXAMPLE III — Self Test Unable to Isolate Malfunction Use Line Test 
Equipment to Isolate to Subsystem Then to Remote Unit 


Remote and replace unit 
15 minutes to 30 minutes 
1 hour to 2 hours 
15 minutes to 4 hours 
15 minutes to 2 hours 
ESTIMATED 

TOTAL DOWN 1.75 hrs to 8.5 hrs 
TIME 


Shop repair of remote unit 
15 minutes to 30 minutes 
© 1 hour to 2 hours 

15 minutes to 4 hours 
1 hour to 6 hours 
© 15 minutes to 2 hours 

ESTIMATED 

TOTAL DOWN 2.75 hrs to 14.5 hrs 
TIME 
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SECTION 9 


SYSTEM COST 


COST MODEL 


The following analysis is based on 1976 dollars, 1980 's technology 
and large lot consponent prices. 

A model has been used for costing which is representative of electronics 
assembly of hybrid and IC based systems. Basic component cost to the 
manufacturer is computed -as: 

C^=1.1(NlsiPlsI ^HY^HY ^PC^* 


Here: 

C^ = Component cost 

Nlsi =* Number of LSI packages 

Plsi = Unit price in quantity of LSI package 

Nhy» PhY ^ Same as above except for Hybrid packages 

PpQ - Price of printed circuit board 

1.1 = Factor for incidental component and terminal costs. 

Assembly labor is assumed to be 40% of the component cost. This is 
based on the fact that no hand wiring is required and a reasonable level 
of automation is incorporated in assembly, and test. 

Overhead is computed as burden on direct labor at the rate of 
300%. Thus labor plus overhead is equal to: 

Cl-+0H “ 3(0.4C(.) => 1.6C(^. (2) 

If we assume an additional factor of 50% for G & A plus Profit the 
total manufacturing cost is given as: 

CjjpG “ + ^L+OH^ ~ 1.5(2. 6 Cq) 


or 


Cmfg ** 3.9Cg.. (3) 

The product is assumed to be handled by a distrubuter and retailer 
before it gets to a customer. If the distributer makes 15% of the retail 
price and the dealer (retailer) makes 45% then the retail selling price 
P^ is: 

Pr = CjifG 

Pr “ 2.5Cjjj.g «= 9.75Cc 
We will assume for the sake of our model 

Pr - lOCc- (4) 
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Component cost for subsystems are computed approximately as given 
in equation (1) above. In the case of the system box cost, a retail 
price has simply been estimated on the basis of present day mechanical 
structures. We assume for the sake of making conservative estimates that 

PpC = 2 dollar/board (large) or 1 dollar/board (small) 

PlSI = 0*75 dollar/package 
^Hybrid “ 7.0 dollar /package. 

COST ANALYSIS EXAMPLE 


As an example calculation we take the main board of the NAY 1 
subsystem. This board contains ONNI and DME units. The component 
count is 


NflY = 11 

NlSI “ 17 

Thus Cj. « 1.1(12.75 + 77 + 2) 100 dollars 

Based on the model equation (4) we predict a retail selling price of 
pR « $1,000 per nav board'. 

As a second example- consider a COM board. In this case 


Nhy 

Nisi 


=-5 


3 


Thus 

Cc = 1.1(2.25 + 35 + 2) = 43.18 dollars 

and 


= $432 per COMM board 

A typical remote rf unit is that of the ADF receiver, 
antenna we have a component count of 


Mounted at the 


Hhy = 3 

Thus 

C^ “ 1.1(21 + 1) = 24.2 dollars 

and 

Pj. “ $242 per remote unit, not Including antenna. 
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COST ESTIMATES ASSUMPTIONS 


Rather than detail each unit we estimate system costs based on 
the following guidelines. 

1) CPS and NAV boards are comparable high complexity. The price 
of complex boards will be assumed to be $1>000. 

2) All other main boards have complexity comparable to the COM. 

Thus all low complexity boards will be assumed to cost $450. 

3) All remote RF units will be assumed to cost $250, i.e. approximately 
that of the ADF remote unit. 

4) We assume the existence of two sizes of main system box. A 
large box which holds .at least 22 cards, and a small box holding 
a maximum of 10 cards. Prices of these boxes including the 
power system protector/ regulatpr and special keypad are projected 
to be : 

, Large - $500 
Small - $350 

5) Display panel, bezel, and electronic driver/power supply 
assembly cost is estimated at $1,000. 

6) Mass Memory tape mechanism and associated electronics cost 
is $700. 

7) Sensors typical of EGT, RPM, etc. are figured at $55 each, KAM 
air is estimated at $115. Gyros are priced at $400 each. 

8) Actuator motors and associated gear assembly are cost at $150 each. 

9) Avionics system battery is assumed to cost $35.00. 

10) The Remote Station units associated with the Sensor-Transducer 
subsystem are cost out using a model similar to that used for 
the remote RF units. The result is a price of $500 each. 


229 



TYPICAL SYSTEM COST 


For purposes of cost-complexity evaluations three system configurations 
are presented. 

Full Implementation (IFR Cessna 402) 

System Box Cards: 


(4 CPS, 2 NAV) 0 

1,000 

6,000 

(2 COMM, FF, WA, VG, 



2 S/A, 2 Dlsp, MM) 

Remote RF units (2 Omni, 2 Cora', 

0 450 

4,500 

ADF, GS, DME, XPNDR, W/A 

0 250 

2,250 

System box, etc 

0 500 

2,000 

2 Display Panels 0 

1,000 

2,000 

4 Remote S/A units 

0 500 

2,000 

Sensors and Actuators (including 


3 Gyros and full autipilot) 


5,900 

Mass Memory Tape Unit 

0 700 

700 

Total $23,850, 


Single Engine New Installation 

We assume this to be primarily a VFS. application with moderate 
room for expansion. 


System Box Cards: 


(2 CPS, 1 NAV (Omni, ADF)) @ 1,000 3,000 
(1 Disp, 1 COM, 1 S/A, FF, MM) 0 450 2,250 
Remote RF Units (Omni, ADF, 

COM, XPND) 0 250 1,000 
System box, small 0 350 350 
Display Panel 0 1,000 1,000 
Sensors (2 Gyros, no 

actuators ) 1,662 
Mass Memory Tape Unit 700 


Total $9,962. ' 


Partial Retrofit, Single Engine 

In this case we assume an owner buys a minimum amount of 
advanced avionics, planning to add capability later. He keeps most 
of his original panel except for the radio complex. 
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System Box Cards: 


(1 CPS, 1 NAV (Omni, ADF)) 

0 1,000 

2,000 

(1 COM, FF;, Disp) 

0 450 

1,350 

Remote RF Units (Omni, 



ADF, XPND, COM) 

0 "250 

1,000 

System box, small 

0 350 

350 

a Display Panel 

0 1,000 

1,000" 


Total $5,700 


Conclusion 

We note a price range from approximately $5,000 to about" $25 ,,000. 
The minimum system price is reasonably high. This is characteristic 
of any Integrated system where a .base component level must initially 
exist before one can build. However, the minimum system is amazingly 
powerful. The pilot still has area nav capability even though he has 
no map display. He has redundancy because of retaining most of the 
original mechanical panel. His workload is tremendously reduced because 
of the computer based assist and tactile touch panel capabilities. 

And finally, he can add to his system a little at a time with no 
modifications' to what is already there. Simply add a system printed 
circuit card with self-contained transferable software, and any required 
remote units. 

The overall system design is indeed cost effective, modular 
and flexible. 


of page js 
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SECTION 10 


RISK ANALYSIS 


INTRODUCTION 

A subsystem by subsystem appraisal is made of the risk 
involved in trying to construct a prototype of the described 
design in three years and the design risk as viewed against 
expected components in the next 10 to 15 years. 


SYSTEM INFORMATION BUSES 

Several manufacturers are in the process of designing 
chips to perform many of the IEEE-488 bus functions. In 
view of the wide acceptance of this standard by instrument 
manufacturers, such chips will probably be available in the 
next year and certainly in two. Little risk is perceived in 
adopting this standard in the prototype, and none at all in 
future avionics systems. The prototype system may need to 
have additional circuitry on the card to implement the 
controller function, whereas in 5 years this should also be 
obtainable in an LSI BIM. 


SYSTEM CENTRAL PROCESSOR 

The team architecture seems viable, especially since 
one way of implementing the structure has been worked out in 
some detail. There is little doubt that other ways will be 
found, some will be much better. Simulation of the team 
architecture will help to solve problems which seem to 
inevitably exist in any detailed undertaking. 

The exact size of the Individual CPSs needed is unknown 
at this time. A small CPS would be able to perform a few 
system functions and a large fast one many functions. 
Probably, much as has been the experience on ground based 
computers, for awhile, an overload of tasks will be found 
for CPSs as large as can be squeezed into the system box. A 
few functions may do for some pilots, but software and 
expanded capabilities pushing the state of the 
processor-memory microart will be possible for those who 
desire to pay for them. The prototype design probably can 
function to demonstrate the concepts using something on the 
order of a M6800. A fully functioning system will probably 
require more powerful CPSs which will increasingly be 
available in the years to come. 

Although a prototype system can be built without CCD or 
other local mass memory, future systems will need it. Such 
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mass memory- will become so cheap that the improved system 
capabilities provided by libraries of programs stored in it| 
will become indispensible. 

The microprogramming capability of this CPS design 
would make the lOS simpler, but any processor can be used to 
process the software of another, given sufficient memory and 
a vast enough translator in the lOS. The lOS and the CPSs 
would usually be supplied by the same manufacturer with a 
specified integration capability to handle other processors 
and languages in the other subsystems. The greatest risk 
here is a continued attempt by the industry to not 
standardize in an effort to capture the entire system 
purchase. Software specialists must then be inventive in an 
attempt tp integrate the divergent packages with as little 
trama as possible for the Installation facility. 


SENSOR ACTUATOR SUBSYSTEM 

The sensors examined in this design are rapidly 
becoming, or are standard in the industry. Similarly, the 
microprocessor technology is considered verly low risk. The 
differential transmitter-receiver serial bus is also 
considered to be low risk in view of the simple tests 
conducted as described below. 

A test of the differential driver receiver bus approach 
was made in a Cessna 182. The test was of sufficient 
duration to confirm that the error rate would be 
substantially below 1 bit in 100 million. The VCO driver 
was in the engine compartment, with much extra twisted 
shielded cable wound around the areas of the alternator, 
magnetos, and plug leads. Despite such over ambitious 
exposure, the only errors were recorded when power 
transients changed the drive frequency of the test VCO. 

This caused the instrumentation phase lock loop' to 
temporarily loose sync. It was felt that the technique is 
essentially error free in an engine environment of even much 
noisier character than that in the test plane. A spark plug 
cap was removed and the twisted pair wrapped about it on the 
ground with no errors observed in the serial link. When the 
Mark 12 was turned on, the strobes turned on, or the engine 
started, errors were recorded. The oscilloscope indicated 
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severe 14 volt transients during these periods. A regulated 
supply for the test VCO would have removed these errors. 

The installation, supervised by Mr. Larry Birkhead under the 
SIU Avionics repair station, and verbally concurred by Bob 
Ellis,’ the avionics GADO representative was flight tested. 
Transponder, Marker beacon, communications, ADF, were all 
activated with no errors caused. At the end of the test, :a 
period of 23 minutes was run without error. A confirmation 
was made at the end that the error detection, and the test 
circuits were still operating properly. The VCO frequency 
was about 96,000 Hz 


DISPLAY SUBSYSTEM 

The technology proposed for the flat panel display is 
off the shelf and it only needs to be packaged for the 
aircraft. Some work is needed in the areas of power supply, 
and new components are under development by manufacturers, 
for the high voltage address drivers. In the next. 10 years 
color may become available in plasma, and PLZT, or liquid 
crystal may become competitive for such a display. It is . 
clear that a flat panel digital display of some type will be 
used instead of the heavy, high voltage CRT. 


NAVIGATION SUBSYSTEM 

Many technologies are vying for this part of the 
system. These will continue to change and be enhanced for 
many years in the future. The VOR-DME-ADF seem secure for 
the next 10 years, but may start to wane somewhere in that 
time span. The system concept is quite Independent of 
whatever navigation methods are used, and so a VOR-DME-ADF 
based navigation is reasonable for the prototype, system. It 
is in the system in a modular fashion for future replacement 
however . 


COMMUNICATION SUBSYSTEM 

This subsystem is not considered a risk for the 
prototype system. During the next 10 years it will probably 
be enhanced by a digital link suplement. This could be 
included in this subsystem module when it becomes clear what 
it will be. If the rest of the fleet moves at the same 
speed that the airlines have in implementing digital links, 
then it will not be a factor for many more decades yet. 
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(RTCA proposed digital links for the airlines in the 1948. 
Some plan to install them in the next few years.) 


FLIGHT FOLLOWING SUBSYSTEM 

The transponder will suffice for the prototype system. 
DABS, IPC, or any other aircraft following and control 
method can be placed in this position in the future as the 
FAA homes in on a selected set of techniques. 


STORM AND TERRAIN AVOIDANCE SUBSYSTEM 

A Ryan stormscope is deemed a good subsystem to use as 
the storm avoidance technique.' Although the years of 
turbulence data vs lightning are yet to be amassed, so far 
all reports indicate that this method works as well as 
radar. Both techniques are not Infallible separately, and 
Jointly may come a little closer. If only one can be placed 
in the system, we would suggest it be the stormscope 
approach. The present display on the device will be 
improved by overlaying the map with it, as well as keeping a 
heading or north up presentation. More advanced digital 
processing of the signal is also possible. This technology 
is Judged low risk for both the prototype and future IAS 
systems . 

Whether anyone will take up the task of putting the 
required terraign obstruction altitudes in memory depends on 
how many planes need it'. But, the ability to include this 
feature is available in this system. 


VOICE GENERATION SUBSYSTEM 

This subsystem is considered to be low risk both for 
the prototype and future general aviation avionics systems. 


SYSTEM POWER 

Necessary power components now exist to make the 
prototype system, although in some cases the fit , and 
cooling will be tight. In the next ten years an expected 
improvement of 2-3 in the power consumed by the subsystem 
components should improve the situation. 


AUDIO UNIT AND SPECIAL FUNCTION KEYBOARD SUBSYSTEM 

No technology is used in this design which would 
suggest any risk for wither the prototype or future MS. 
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mAss memory subsystem 

Off the shelf units were selected for this design. But 
holofische may be in use in 10-15 years. Vibration is still, 
a problem for the precision optics in an aircraft 
environment. Other forms of dense cheap ROM could also 
appear on the market in 10-15 years and be quickly 
integrated into the system. 
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SECTION 11 


BESULTS AMD CONCLUSIONS 


This contract resulted in the design of an advanced integrated 
avionics system for general aviation aircraft. Although the design 
in most cases did not proceed to the level of detailed circuitry and 
actual software, sufficient investigation was performed to achieve 
a high degree of confidence in the system concepts. In the opinion 
of. the research team, the system described is a good approach to use 
in building a practical Integrated avionics system for general aviation. 

To further prove this point, and refine the system design, it will be 
necessary to proceed through the steps of building and testing one or 
more prototype systems. Of special interest has been the realization 
that the vastly increased aircraft monitor and control capability 
offered' by this integrated system, will not cost more than present 
day avionics. Reliability will be Improved to the point where avionics 
will be presumed working to the same degree as the airframe and engine 
are at this time. The Increased usage of the airspace made possible 
by the greater ease with which precision flight may be accoiiq>llshed 
should result in a larger quantity of aircraft coming into demand. 

This should also help to reduce costs in a boot strapping action. 

Some question exists as to the minimum- configuration required to 
prove out the system concept. This would seem to depend on the eye of 
the beholder to a considerable degree. We feel that in addition to 
the triple bus, several team processors, at least one display, a com, 
a nav, and part of the flight following' capability, some of the sensor/ 
actuator subsystem should also be included. In one sense, a con 5 )Uter 
could exercise the bus with a few team processors. This -would give a ‘ 
test of the main architectural features of the system. Further, a display 
could be tied in and more detailed real time hardware simulation provided. 
A cockpit could even be set up and pilots invited in to fly a working 
simulation prototype. But no test is quite equal to actually flying 
the hardware in an actual aircraft. This last step can be very costly 
if taken too quickly. This particular system is different in the sense 
that once the basic flexible hardware has been installed, much change 
can -be made by changing the software in the system. Indeed, this is 
another area where a significant product, to be provided by industry 
innovation, is expected to exist. To actually fly the system, and get 
a hands on feel for its performance and potential,, some of each of the 
subsystems should be included. Voice recognition, engine diagnostics, 
and other advanced concepts- should ultimately be possible. Voice 
generation should be included in the system now. Hopefully funds will 
permit NASA to pursue exploration of this new technology. 
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APPENDIX 

A.CBOH.YMS AND ■ABBREVIATIONS 

A 

Amperes 

AAS 

Advanced Avionics System 

ADF 

Automatic Direction Finder 

A/D 

Analog to Digital (converter) 

AGC 

Automatic Gain Control 

ALS 

Automatic Landing System 

AH 

Acceptor Handshake, IEEE-488 bus function 

AM 

Amplitude Modulation 

ATC 

Air Traffic Control ■ 

ATCHBS 

Air Traffic Control Radio Beacon System 

ATIS 

Automatic Terminal Information Service 

AVC 

Automatic Volume Control 

EGAS 

Beacon Collision Avoidance System 

BIT 

Binary Digit 

BIM 

Bus Interface Module 

C 

Centigrade 

CAC 

Computer Avionics Corporation 

CCD 

Charge Coupled Device 

CE 

Clear Entry 

CHT 

Cylinder Head Temperature 

CLR 

Clear 

cm 

centimeter 

CMOS 

Complementary Metal Oxide Silicon 

CMD 

Command 

COM 

Communications 

CP 

Central Processor 

CPE 

Central Processing Element 

CPS 

Central Processor Subsystem 

Cpt j 

Clearance Delivery 

CR 

Command Register 

DABS 

Discrete Address Beacon System 

DC 

Direct Current 

Det 

Detector 

DFT 

Discrete Fourier Transform 

Disp 

Display 

DMA 

Direct Memory Access 

DMAC 

Direct Memory Access Circuit 

DME 

Distance Measuring Equipment 

DPT 

Departure 

DST 

Destination 

EGT 

Exhaust Gas Temperature 

EPC 

Engine Process Counter 

EPROM 

Erasable Programmable Read Only Memory 

ERA 

Enable Row Address 

EXEC 

software EXECutive 

FET 

Field Effect Transistor 

FF 

Flight Following 

FSS 

Flight Service Station 

F/V 

Frequency /Voltage (converter) 

FPLAN 

Flight Plan 
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FSET Frequency Set 

GPKD General Purpose Keyboard Decoder 

GPS Global Positioning System 

HP High Pass 

hr hour 

Hz Hertz 

IC Integrated Circuit 

ICU Interrupt Control Unit 

ID Identification 

IEEE Institute of Electrical and Electronics Engineers 

I-F Intermediate Frequency 

IFR Instrument flight Rules 

ILS Instrument Landing System 

in inch 

INIT Initialization 

I/O Input/Output 

lOS Initialization Operating System 

ips inches per second 

ISP Integrated System Package 

JLL Intel 3001 Jump Command 

JPR Intel 3001 Jump Command 

JRL Intel 3001 Jump Command 

K Thousand or 10211 

KBI Keyboard Interface 

kg kilogram 

L listener, IEEE-488 bus function 

LAND Landing 

LC Level Counter 

LED Light Emitting Diode 

LLN Level Limit Number 

LO Local Oscillator 

LP Low Pass 

LSI Large Scale Integration 

LTBL Level Table 

in meter 

ma milliampere 

MAN Manifold 

MCU Microprogram Control Unit 

mhz megahertz 

MLS Microwave Landing System 

mm millimeter 

MM Mass Memory 

MOS Metal Oxide' Silicon 

MP Manifold Pressure 

MSI Medium Scale Integration 

MTBF Mean Time Before Failure, (=MTTF) 

MTTF Mean Time To Failure, (=MTBF) 

MUX Multiplexer 

NAV Navigation 

NAND Not AND 

NOAA National Oceanic and Atmospheric Administration 

nm nautical mile 
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NOR 

NTR 

OMEGA 

OMNI' 

OS 

OSB 

P 

PC 

PDC 

PEP ■ 

PFLT 

PHS 

RAM 

RCV 

RF 

ROM 

RPM 

RTS 

S/A 

SCR 

sec 

SH 

S/H 

SIU 

SSI 

SW 

SYSCNG 

T 

TKOFF 

TOC 

TOS 

TQTBL 

TTBL 

T/R 

TRF 

TST 

UART 

UHF 

V 

VCO 

VFR 

VG 

VSD 

WA 

WE . 

WPT 

Xmitter 

XMT 

XPND 


Not OR 

Next Task Register 

LF Navigation Aid 

VHF Navigation Aid 

Operating System 

Operational Status Bit 

Priority 

Printed Circuit 

Parallel Data Controller 

Peak Effective Power 

Preflight 

Pressure 

Random Access Memory 
Receive 

Radio Frequency 

Read Only Memory 

Revolutions Per Minute 

Receiver Transmitter System 

Sensor Actuator 

Silicon Rectifier 

second 

Source Handshake, IEEE-^t88 bus function 

Sample and Hold 

Southern Illinois University’ 

Small Scale Integration 
Switch 

System ..Change 

Talker, IEEE-488 bus function 
Takeoff 

Time'^Out Circuit 
Team Operating System 
Task Que Table 
Task Table 
Transmit Receive 
Tuned Radio Frequency 
Test 

Ifniversai Asynchronous Receiver Transmitter 

Ultra High Frequency 

volts 

Voltage Controlled Oscillator 

Visual Flight Rules 

Voice Generation 

Vertical Situation Display 

Weather Avoidance 

Write Enable 

Waypoint 

Transmitter 

Transmit 

Transponder 
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